xmrig | e5fecef17fedc98925e0f2c0fdce0347355c908de47be2fd160c81c91ca8e6c0

Analysis

max time kernel
43s
max time network
36s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
Size

1.9MB
MD5

08e3d045f868bf4dd44bec5471a5e6f6
SHA1

f5c9dd263da98543026fa11d0a359f5953e4c755
SHA256

e5fecef17fedc98925e0f2c0fdce0347355c908de47be2fd160c81c91ca8e6c0
SHA512

fb423860f23e2cad396fa60c6073ff41e5ed9ffdce8c03f42ba0f0c688f32303c9cb07c7a7909b8b326023a1f40a76ffc499ec6daf80ba5efe5c55cdb972d954
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOD:NABu

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral1/memory/2520-13-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2696-80-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/1720-111-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2564-109-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2636-107-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2376-105-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2632-103-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2640-101-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2520-3850-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2640-3922-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2564-3928-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2636-4002-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2632-3978-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2376-3920-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2520	tHlItRA.exe
2696	Bxwfqes.exe
2640	MiydccD.exe
2632	GVWLTny.exe
2376	kjoJcWt.exe
2636	ngfTSit.exe
2564	cHAtPVF.exe
1720	gKhxKoo.exe
2440	pCZCOnd.exe
1656	aQXnNHS.exe
2876	tOqJvSZ.exe
1624	VwmXeIY.exe
2672	uAxakeE.exe
1784	gylfmts.exe
2500	ErwDAuL.exe
1316	KhGCWSV.exe
2320	RWSSxKZ.exe
1328	RNMOMOo.exe
3064	ilMOnXT.exe
1672	rkYIYaB.exe
2092	STDuGQy.exe
592	DUJOQFh.exe
1812	QiUKqLH.exe
1508	ikogXKH.exe
2732	zTMdkeg.exe
3044	XIONrTk.exe
1964	HkfdpcU.exe
2172	MgEHuoB.exe
1948	PjXhxjM.exe
860	WQWVHwE.exe
848	TZgCNQo.exe
2124	QgpuxoJ.exe
336	FgbjNaI.exe
2364	YyJqAsB.exe
1108	GnUyKuB.exe
704	lBxiHxX.exe
1092	lRElpvD.exe
2808	gapaAhL.exe
920	zzjmlcO.exe
2116	xHRkXGI.exe
1248	nJAfaCG.exe
2300	mgkLjUD.exe
2004	wZjosDW.exe
784	yRclbFw.exe
2272	lKmKosq.exe
2192	QevEsgT.exe
2104	yhVrtWu.exe
2956	jyfcDyz.exe
1504	xZfWyau.exe
876	jxCPNZy.exe
2820	lPkXzWd.exe
2816	FRLIdfg.exe
3060	ISGKxNr.exe
1604	BSdCiGk.exe
1712	KMhILOf.exe
2644	hpuDWDC.exe
2992	QNebiRv.exe
2940	xICBKfa.exe
2560	AbSGMZg.exe
2480	lZLtZMI.exe
1524	LBjdajN.exe
3056	fypLGjl.exe
1628	bLXlRzH.exe
2724	ToQGacQ.exe

Loads dropped DLL 64 IoCs

pid	Process
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1048-1-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x000c000000012674-4.dat	upx
behavioral1/memory/2520-13-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/files/0x0037000000014b4c-14.dat	upx
behavioral1/files/0x000e0000000054ab-23.dat	upx
behavioral1/files/0x0008000000015653-27.dat	upx
behavioral1/files/0x000700000001565d-31.dat	upx
behavioral1/files/0x0006000000015e32-51.dat	upx
behavioral1/files/0x0007000000015684-39.dat	upx
behavioral1/files/0x0007000000015677-34.dat	upx
behavioral1/files/0x0006000000016d5f-187.dat	upx
behavioral1/files/0x0006000000015d93-47.dat	upx
behavioral1/files/0x0006000000016d74-191.dat	upx
behavioral1/files/0x0006000000016d43-181.dat	upx
behavioral1/files/0x00060000000164aa-175.dat	upx
behavioral1/files/0x0006000000016d3a-171.dat	upx
behavioral1/files/0x0006000000016d20-161.dat	upx
behavioral1/files/0x0006000000016d07-152.dat	upx
behavioral1/files/0x0006000000016cb0-145.dat	upx
behavioral1/files/0x0006000000016c5e-134.dat	upx
behavioral1/files/0x0006000000016adc-127.dat	upx
behavioral1/files/0x0006000000015ecc-119.dat	upx
behavioral1/files/0x0006000000016616-117.dat	upx
behavioral1/memory/2696-80-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x0006000000016d3e-178.dat	upx
behavioral1/files/0x000600000001621e-169.dat	upx
behavioral1/files/0x0006000000016d34-167.dat	upx
behavioral1/files/0x0006000000016d18-158.dat	upx
behavioral1/files/0x0006000000016cdc-150.dat	upx
behavioral1/files/0x0006000000015fe5-142.dat	upx
behavioral1/files/0x0006000000016c64-140.dat	upx
behavioral1/files/0x0006000000016c44-132.dat	upx
behavioral1/files/0x0006000000016851-124.dat	upx
behavioral1/files/0x0008000000015d7f-42.dat	upx
behavioral1/memory/1720-111-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2564-109-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2636-107-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2376-105-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2632-103-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2640-101-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/files/0x000600000001658a-97.dat	upx
behavioral1/files/0x000600000001630a-96.dat	upx
behavioral1/files/0x000600000001610f-90.dat	upx
behavioral1/files/0x0006000000015f65-89.dat	upx
behavioral1/files/0x0006000000015d87-85.dat	upx
behavioral1/memory/2520-3850-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2640-3922-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2564-3928-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2636-4002-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2632-3978-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2376-3920-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qCtBrHb.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\bWqCMuV.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\GrZJMRw.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\WQVCDPN.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\crOrgyK.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\fifsWOI.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\AZxNTfe.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\iisLOgG.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\ixaLwLP.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\tyzRfGd.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\RRrQWbd.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\VoXpOYX.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\lPkXzWd.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\LLYAGQR.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\pKbQXkX.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\ptcHIZn.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\KirHABg.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\rYSwrWM.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\lMGAaKE.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\UzIFHWU.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\xOXCJXp.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\pthKPTg.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\hjdezXG.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\AtwptqV.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\OcJLxII.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\BNMpORm.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\ADnqcpx.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\KhGCWSV.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\PfStepB.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\HdyRIqp.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\QDKZQsC.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\tgTkwEa.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\VKWvbEc.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\rIVrYWd.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\twDaOSZ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\SxbAGIW.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\WCSBpCo.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\DuWnIFe.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\DfwUNqd.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\NsXdyXX.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\pohmYGV.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\BriGxEk.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\BegZdVU.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\llHZFFz.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\cYJgaSj.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\IsmyuOr.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\SWAoumk.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\qPVEcEx.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\uVteFzd.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\kjoJcWt.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\GEEGQnS.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\RlaUMFe.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\uZSacMy.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\STDuGQy.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\JWxCbNZ.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\KXANgcn.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\WTpnOCp.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\oNYYwZq.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\mPMtrFr.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\GAHCLjs.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\BwxWFri.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\AgGcYvb.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\hcOvZNW.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
File created	C:\Windows\System\xWUKfEc.exe	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1992	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
Token: SeDebugPrivilege	1992	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1992	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	29
PID 1048 wrote to memory of 1992	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	29
PID 1048 wrote to memory of 1992	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	29
PID 1048 wrote to memory of 2520	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	30
PID 1048 wrote to memory of 2520	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	30
PID 1048 wrote to memory of 2520	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	30
PID 1048 wrote to memory of 2696	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2696	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2696	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	31
PID 1048 wrote to memory of 2640	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	32
PID 1048 wrote to memory of 2640	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	32
PID 1048 wrote to memory of 2640	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	32
PID 1048 wrote to memory of 2632	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	33
PID 1048 wrote to memory of 2632	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	33
PID 1048 wrote to memory of 2632	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	33
PID 1048 wrote to memory of 2376	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	34
PID 1048 wrote to memory of 2376	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	34
PID 1048 wrote to memory of 2376	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	34
PID 1048 wrote to memory of 2636	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	35
PID 1048 wrote to memory of 2636	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	35
PID 1048 wrote to memory of 2636	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	35
PID 1048 wrote to memory of 2564	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	36
PID 1048 wrote to memory of 2564	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	36
PID 1048 wrote to memory of 2564	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	36
PID 1048 wrote to memory of 1720	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	37
PID 1048 wrote to memory of 1720	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	37
PID 1048 wrote to memory of 1720	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	37
PID 1048 wrote to memory of 2440	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	38
PID 1048 wrote to memory of 2440	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	38
PID 1048 wrote to memory of 2440	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	38
PID 1048 wrote to memory of 2500	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	39
PID 1048 wrote to memory of 2500	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	39
PID 1048 wrote to memory of 2500	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	39
PID 1048 wrote to memory of 1656	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	40
PID 1048 wrote to memory of 1656	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	40
PID 1048 wrote to memory of 1656	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	40
PID 1048 wrote to memory of 1316	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	41
PID 1048 wrote to memory of 1316	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	41
PID 1048 wrote to memory of 1316	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	41
PID 1048 wrote to memory of 2876	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	42
PID 1048 wrote to memory of 2876	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	42
PID 1048 wrote to memory of 2876	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	42
PID 1048 wrote to memory of 1672	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	43
PID 1048 wrote to memory of 1672	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	43
PID 1048 wrote to memory of 1672	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	43
PID 1048 wrote to memory of 1624	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	44
PID 1048 wrote to memory of 1624	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	44
PID 1048 wrote to memory of 1624	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	44
PID 1048 wrote to memory of 1508	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	45
PID 1048 wrote to memory of 1508	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	45
PID 1048 wrote to memory of 1508	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	45
PID 1048 wrote to memory of 2672	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	46
PID 1048 wrote to memory of 2672	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	46
PID 1048 wrote to memory of 2672	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	46
PID 1048 wrote to memory of 2732	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	47
PID 1048 wrote to memory of 2732	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	47
PID 1048 wrote to memory of 2732	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	47
PID 1048 wrote to memory of 1784	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	48
PID 1048 wrote to memory of 1784	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	48
PID 1048 wrote to memory of 1784	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	48
PID 1048 wrote to memory of 2172	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	49
PID 1048 wrote to memory of 2172	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	49
PID 1048 wrote to memory of 2172	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	49
PID 1048 wrote to memory of 2320	1048	08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08e3d045f868bf4dd44bec5471a5e6f6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\System\tHlItRA.exe
  C:\Windows\System\tHlItRA.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\Bxwfqes.exe
  C:\Windows\System\Bxwfqes.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\MiydccD.exe
  C:\Windows\System\MiydccD.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\GVWLTny.exe
  C:\Windows\System\GVWLTny.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\kjoJcWt.exe
  C:\Windows\System\kjoJcWt.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ngfTSit.exe
  C:\Windows\System\ngfTSit.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\cHAtPVF.exe
  C:\Windows\System\cHAtPVF.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\gKhxKoo.exe
  C:\Windows\System\gKhxKoo.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\pCZCOnd.exe
  C:\Windows\System\pCZCOnd.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ErwDAuL.exe
  C:\Windows\System\ErwDAuL.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\aQXnNHS.exe
  C:\Windows\System\aQXnNHS.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\KhGCWSV.exe
  C:\Windows\System\KhGCWSV.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\tOqJvSZ.exe
  C:\Windows\System\tOqJvSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\rkYIYaB.exe
  C:\Windows\System\rkYIYaB.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\VwmXeIY.exe
  C:\Windows\System\VwmXeIY.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\ikogXKH.exe
  C:\Windows\System\ikogXKH.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\uAxakeE.exe
  C:\Windows\System\uAxakeE.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\zTMdkeg.exe
  C:\Windows\System\zTMdkeg.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\gylfmts.exe
  C:\Windows\System\gylfmts.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\MgEHuoB.exe
  C:\Windows\System\MgEHuoB.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\RWSSxKZ.exe
  C:\Windows\System\RWSSxKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\WQWVHwE.exe
  C:\Windows\System\WQWVHwE.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\RNMOMOo.exe
  C:\Windows\System\RNMOMOo.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\TZgCNQo.exe
  C:\Windows\System\TZgCNQo.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\ilMOnXT.exe
  C:\Windows\System\ilMOnXT.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\QgpuxoJ.exe
  C:\Windows\System\QgpuxoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\STDuGQy.exe
  C:\Windows\System\STDuGQy.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\FgbjNaI.exe
  C:\Windows\System\FgbjNaI.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\DUJOQFh.exe
  C:\Windows\System\DUJOQFh.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\YyJqAsB.exe
  C:\Windows\System\YyJqAsB.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\QiUKqLH.exe
  C:\Windows\System\QiUKqLH.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\GnUyKuB.exe
  C:\Windows\System\GnUyKuB.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\XIONrTk.exe
  C:\Windows\System\XIONrTk.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\lBxiHxX.exe
  C:\Windows\System\lBxiHxX.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\HkfdpcU.exe
  C:\Windows\System\HkfdpcU.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\lRElpvD.exe
  C:\Windows\System\lRElpvD.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\PjXhxjM.exe
  C:\Windows\System\PjXhxjM.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\gapaAhL.exe
  C:\Windows\System\gapaAhL.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\zzjmlcO.exe
  C:\Windows\System\zzjmlcO.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\xHRkXGI.exe
  C:\Windows\System\xHRkXGI.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\nJAfaCG.exe
  C:\Windows\System\nJAfaCG.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\mgkLjUD.exe
  C:\Windows\System\mgkLjUD.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\wZjosDW.exe
  C:\Windows\System\wZjosDW.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\yRclbFw.exe
  C:\Windows\System\yRclbFw.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\lKmKosq.exe
  C:\Windows\System\lKmKosq.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\QevEsgT.exe
  C:\Windows\System\QevEsgT.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\yhVrtWu.exe
  C:\Windows\System\yhVrtWu.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\jyfcDyz.exe
  C:\Windows\System\jyfcDyz.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\xZfWyau.exe
  C:\Windows\System\xZfWyau.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\jxCPNZy.exe
  C:\Windows\System\jxCPNZy.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\lPkXzWd.exe
  C:\Windows\System\lPkXzWd.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\FRLIdfg.exe
  C:\Windows\System\FRLIdfg.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ISGKxNr.exe
  C:\Windows\System\ISGKxNr.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\BSdCiGk.exe
  C:\Windows\System\BSdCiGk.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\KMhILOf.exe
  C:\Windows\System\KMhILOf.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\hpuDWDC.exe
  C:\Windows\System\hpuDWDC.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\QNebiRv.exe
  C:\Windows\System\QNebiRv.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\xICBKfa.exe
  C:\Windows\System\xICBKfa.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\AbSGMZg.exe
  C:\Windows\System\AbSGMZg.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\lZLtZMI.exe
  C:\Windows\System\lZLtZMI.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\LBjdajN.exe
  C:\Windows\System\LBjdajN.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\fypLGjl.exe
  C:\Windows\System\fypLGjl.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\bLXlRzH.exe
  C:\Windows\System\bLXlRzH.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\ToQGacQ.exe
  C:\Windows\System\ToQGacQ.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\VumMPGl.exe
  C:\Windows\System\VumMPGl.exe
  2⤵
  PID:2692
- C:\Windows\System\buWThGF.exe
  C:\Windows\System\buWThGF.exe
  2⤵
  PID:1704
- C:\Windows\System\pQkkyJE.exe
  C:\Windows\System\pQkkyJE.exe
  2⤵
  PID:2352
- C:\Windows\System\jmHpwVZ.exe
  C:\Windows\System\jmHpwVZ.exe
  2⤵
  PID:1040
- C:\Windows\System\vnyyJZd.exe
  C:\Windows\System\vnyyJZd.exe
  2⤵
  PID:2752
- C:\Windows\System\mghGVOy.exe
  C:\Windows\System\mghGVOy.exe
  2⤵
  PID:1036
- C:\Windows\System\NLHQhPd.exe
  C:\Windows\System\NLHQhPd.exe
  2⤵
  PID:328
- C:\Windows\System\OAbWWYh.exe
  C:\Windows\System\OAbWWYh.exe
  2⤵
  PID:1820
- C:\Windows\System\yDCzqQP.exe
  C:\Windows\System\yDCzqQP.exe
  2⤵
  PID:1420
- C:\Windows\System\fPKiEUu.exe
  C:\Windows\System\fPKiEUu.exe
  2⤵
  PID:1544
- C:\Windows\System\ofKGDHM.exe
  C:\Windows\System\ofKGDHM.exe
  2⤵
  PID:1300
- C:\Windows\System\VZGoAxU.exe
  C:\Windows\System\VZGoAxU.exe
  2⤵
  PID:840
- C:\Windows\System\sGuBbzd.exe
  C:\Windows\System\sGuBbzd.exe
  2⤵
  PID:1612
- C:\Windows\System\jBhUAkO.exe
  C:\Windows\System\jBhUAkO.exe
  2⤵
  PID:2980
- C:\Windows\System\KQLrrQv.exe
  C:\Windows\System\KQLrrQv.exe
  2⤵
  PID:1608
- C:\Windows\System\jioXWQK.exe
  C:\Windows\System\jioXWQK.exe
  2⤵
  PID:952
- C:\Windows\System\KGZBZhH.exe
  C:\Windows\System\KGZBZhH.exe
  2⤵
  PID:2788
- C:\Windows\System\EyTRFcl.exe
  C:\Windows\System\EyTRFcl.exe
  2⤵
  PID:1684
- C:\Windows\System\DgLPwbQ.exe
  C:\Windows\System\DgLPwbQ.exe
  2⤵
  PID:768
- C:\Windows\System\QoaqZlX.exe
  C:\Windows\System\QoaqZlX.exe
  2⤵
  PID:1928
- C:\Windows\System\uXwtLjQ.exe
  C:\Windows\System\uXwtLjQ.exe
  2⤵
  PID:812
- C:\Windows\System\CiXCWSz.exe
  C:\Windows\System\CiXCWSz.exe
  2⤵
  PID:2332
- C:\Windows\System\ogElCPz.exe
  C:\Windows\System\ogElCPz.exe
  2⤵
  PID:2212
- C:\Windows\System\pakKLHE.exe
  C:\Windows\System\pakKLHE.exe
  2⤵
  PID:2928
- C:\Windows\System\tNgwyPb.exe
  C:\Windows\System\tNgwyPb.exe
  2⤵
  PID:2656
- C:\Windows\System\bIaJUSk.exe
  C:\Windows\System\bIaJUSk.exe
  2⤵
  PID:2528
- C:\Windows\System\ZKginYW.exe
  C:\Windows\System\ZKginYW.exe
  2⤵
  PID:2476
- C:\Windows\System\WvbRYQu.exe
  C:\Windows\System\WvbRYQu.exe
  2⤵
  PID:2516
- C:\Windows\System\UGTVehB.exe
  C:\Windows\System\UGTVehB.exe
  2⤵
  PID:384
- C:\Windows\System\SadiERI.exe
  C:\Windows\System\SadiERI.exe
  2⤵
  PID:696
- C:\Windows\System\hwQleQn.exe
  C:\Windows\System\hwQleQn.exe
  2⤵
  PID:2484
- C:\Windows\System\mORTpJU.exe
  C:\Windows\System\mORTpJU.exe
  2⤵
  PID:1324
- C:\Windows\System\aVfwRyv.exe
  C:\Windows\System\aVfwRyv.exe
  2⤵
  PID:2744
- C:\Windows\System\nksGIoi.exe
  C:\Windows\System\nksGIoi.exe
  2⤵
  PID:1032
- C:\Windows\System\JBymYwr.exe
  C:\Windows\System\JBymYwr.exe
  2⤵
  PID:2308
- C:\Windows\System\afxDaTf.exe
  C:\Windows\System\afxDaTf.exe
  2⤵
  PID:1096
- C:\Windows\System\MncBCLs.exe
  C:\Windows\System\MncBCLs.exe
  2⤵
  PID:2348
- C:\Windows\System\bQrkcbl.exe
  C:\Windows\System\bQrkcbl.exe
  2⤵
  PID:2220
- C:\Windows\System\ZXlzVyh.exe
  C:\Windows\System\ZXlzVyh.exe
  2⤵
  PID:2232
- C:\Windows\System\PRttZRW.exe
  C:\Windows\System\PRttZRW.exe
  2⤵
  PID:1216
- C:\Windows\System\CqyDkLm.exe
  C:\Windows\System\CqyDkLm.exe
  2⤵
  PID:2968
- C:\Windows\System\Ydioyvh.exe
  C:\Windows\System\Ydioyvh.exe
  2⤵
  PID:1856
- C:\Windows\System\ZtgyBtN.exe
  C:\Windows\System\ZtgyBtN.exe
  2⤵
  PID:692
- C:\Windows\System\HYmUbgK.exe
  C:\Windows\System\HYmUbgK.exe
  2⤵
  PID:1788
- C:\Windows\System\oMsXyZA.exe
  C:\Windows\System\oMsXyZA.exe
  2⤵
  PID:332
- C:\Windows\System\KCtKKfr.exe
  C:\Windows\System\KCtKKfr.exe
  2⤵
  PID:1124
- C:\Windows\System\riGjSMu.exe
  C:\Windows\System\riGjSMu.exe
  2⤵
  PID:1752
- C:\Windows\System\Tsbpuse.exe
  C:\Windows\System\Tsbpuse.exe
  2⤵
  PID:2032
- C:\Windows\System\tgTkwEa.exe
  C:\Windows\System\tgTkwEa.exe
  2⤵
  PID:1616
- C:\Windows\System\dCXrQrp.exe
  C:\Windows\System\dCXrQrp.exe
  2⤵
  PID:2436
- C:\Windows\System\NsXdyXX.exe
  C:\Windows\System\NsXdyXX.exe
  2⤵
  PID:1664
- C:\Windows\System\pLprhjI.exe
  C:\Windows\System\pLprhjI.exe
  2⤵
  PID:2336
- C:\Windows\System\fPIUrnK.exe
  C:\Windows\System\fPIUrnK.exe
  2⤵
  PID:1500
- C:\Windows\System\MFSTaWM.exe
  C:\Windows\System\MFSTaWM.exe
  2⤵
  PID:2972
- C:\Windows\System\yqLBMeN.exe
  C:\Windows\System\yqLBMeN.exe
  2⤵
  PID:2584
- C:\Windows\System\HYXclEF.exe
  C:\Windows\System\HYXclEF.exe
  2⤵
  PID:1696
- C:\Windows\System\lFgeQmq.exe
  C:\Windows\System\lFgeQmq.exe
  2⤵
  PID:2448
- C:\Windows\System\DcOaRdx.exe
  C:\Windows\System\DcOaRdx.exe
  2⤵
  PID:2156
- C:\Windows\System\tCCBAWQ.exe
  C:\Windows\System\tCCBAWQ.exe
  2⤵
  PID:2776
- C:\Windows\System\EvJcSPl.exe
  C:\Windows\System\EvJcSPl.exe
  2⤵
  PID:1312
- C:\Windows\System\ZdqKFWf.exe
  C:\Windows\System\ZdqKFWf.exe
  2⤵
  PID:2704
- C:\Windows\System\LpHBwsD.exe
  C:\Windows\System\LpHBwsD.exe
  2⤵
  PID:2612
- C:\Windows\System\suLbebI.exe
  C:\Windows\System\suLbebI.exe
  2⤵
  PID:2588
- C:\Windows\System\BklilIK.exe
  C:\Windows\System\BklilIK.exe
  2⤵
  PID:912
- C:\Windows\System\bJjzuwh.exe
  C:\Windows\System\bJjzuwh.exe
  2⤵
  PID:1356
- C:\Windows\System\SzaNEMi.exe
  C:\Windows\System\SzaNEMi.exe
  2⤵
  PID:2356
- C:\Windows\System\wHhWDpB.exe
  C:\Windows\System\wHhWDpB.exe
  2⤵
  PID:2852
- C:\Windows\System\oBlfTzK.exe
  C:\Windows\System\oBlfTzK.exe
  2⤵
  PID:1424
- C:\Windows\System\aHyZqOh.exe
  C:\Windows\System\aHyZqOh.exe
  2⤵
  PID:1440
- C:\Windows\System\cMTwtOt.exe
  C:\Windows\System\cMTwtOt.exe
  2⤵
  PID:2360
- C:\Windows\System\ZyznXVg.exe
  C:\Windows\System\ZyznXVg.exe
  2⤵
  PID:2768
- C:\Windows\System\JQUVyDl.exe
  C:\Windows\System\JQUVyDl.exe
  2⤵
  PID:2180
- C:\Windows\System\rPGxKZH.exe
  C:\Windows\System\rPGxKZH.exe
  2⤵
  PID:1568
- C:\Windows\System\AsTOvkF.exe
  C:\Windows\System\AsTOvkF.exe
  2⤵
  PID:1556
- C:\Windows\System\fXerQjj.exe
  C:\Windows\System\fXerQjj.exe
  2⤵
  PID:2548
- C:\Windows\System\gbqZMkJ.exe
  C:\Windows\System\gbqZMkJ.exe
  2⤵
  PID:2552
- C:\Windows\System\PXRnyDp.exe
  C:\Windows\System\PXRnyDp.exe
  2⤵
  PID:1320
- C:\Windows\System\yllPgzd.exe
  C:\Windows\System\yllPgzd.exe
  2⤵
  PID:1636
- C:\Windows\System\CDwqqkD.exe
  C:\Windows\System\CDwqqkD.exe
  2⤵
  PID:2148
- C:\Windows\System\mtzzzMi.exe
  C:\Windows\System\mtzzzMi.exe
  2⤵
  PID:2568
- C:\Windows\System\eyWjfZX.exe
  C:\Windows\System\eyWjfZX.exe
  2⤵
  PID:2920
- C:\Windows\System\qBJChdC.exe
  C:\Windows\System\qBJChdC.exe
  2⤵
  PID:2084
- C:\Windows\System\vTGKwTz.exe
  C:\Windows\System\vTGKwTz.exe
  2⤵
  PID:2708
- C:\Windows\System\rfoYxML.exe
  C:\Windows\System\rfoYxML.exe
  2⤵
  PID:1488
- C:\Windows\System\kgJbQWL.exe
  C:\Windows\System\kgJbQWL.exe
  2⤵
  PID:1396
- C:\Windows\System\NDdIiMv.exe
  C:\Windows\System\NDdIiMv.exe
  2⤵
  PID:1804
- C:\Windows\System\hWUglYc.exe
  C:\Windows\System\hWUglYc.exe
  2⤵
  PID:1276
- C:\Windows\System\TsTgJMU.exe
  C:\Windows\System\TsTgJMU.exe
  2⤵
  PID:888
- C:\Windows\System\IkJVDox.exe
  C:\Windows\System\IkJVDox.exe
  2⤵
  PID:1160
- C:\Windows\System\PYllmpk.exe
  C:\Windows\System\PYllmpk.exe
  2⤵
  PID:2284
- C:\Windows\System\oFHrXza.exe
  C:\Windows\System\oFHrXza.exe
  2⤵
  PID:1960
- C:\Windows\System\eQLWcrd.exe
  C:\Windows\System\eQLWcrd.exe
  2⤵
  PID:2904
- C:\Windows\System\PAozTAy.exe
  C:\Windows\System\PAozTAy.exe
  2⤵
  PID:1740
- C:\Windows\System\TMehNni.exe
  C:\Windows\System\TMehNni.exe
  2⤵
  PID:676
- C:\Windows\System\OQEIYGp.exe
  C:\Windows\System\OQEIYGp.exe
  2⤵
  PID:2728
- C:\Windows\System\qewesfu.exe
  C:\Windows\System\qewesfu.exe
  2⤵
  PID:2340
- C:\Windows\System\oxgDxmL.exe
  C:\Windows\System\oxgDxmL.exe
  2⤵
  PID:352
- C:\Windows\System\CvlhcFx.exe
  C:\Windows\System\CvlhcFx.exe
  2⤵
  PID:2316
- C:\Windows\System\AGQIKnX.exe
  C:\Windows\System\AGQIKnX.exe
  2⤵
  PID:3016
- C:\Windows\System\SIyhJEB.exe
  C:\Windows\System\SIyhJEB.exe
  2⤵
  PID:2804
- C:\Windows\System\OHnqWyg.exe
  C:\Windows\System\OHnqWyg.exe
  2⤵
  PID:1848
- C:\Windows\System\NolWVah.exe
  C:\Windows\System\NolWVah.exe
  2⤵
  PID:2468
- C:\Windows\System\rtvYzUG.exe
  C:\Windows\System\rtvYzUG.exe
  2⤵
  PID:3048
- C:\Windows\System\fyrNqHN.exe
  C:\Windows\System\fyrNqHN.exe
  2⤵
  PID:3084
- C:\Windows\System\JWxCbNZ.exe
  C:\Windows\System\JWxCbNZ.exe
  2⤵
  PID:3100
- C:\Windows\System\rupbRkU.exe
  C:\Windows\System\rupbRkU.exe
  2⤵
  PID:3116
- C:\Windows\System\vJEKadb.exe
  C:\Windows\System\vJEKadb.exe
  2⤵
  PID:3136
- C:\Windows\System\DisXxcy.exe
  C:\Windows\System\DisXxcy.exe
  2⤵
  PID:3160
- C:\Windows\System\wjsJXwK.exe
  C:\Windows\System\wjsJXwK.exe
  2⤵
  PID:3176
- C:\Windows\System\rNEHGuw.exe
  C:\Windows\System\rNEHGuw.exe
  2⤵
  PID:3192
- C:\Windows\System\SCzqZOY.exe
  C:\Windows\System\SCzqZOY.exe
  2⤵
  PID:3208
- C:\Windows\System\crlZzay.exe
  C:\Windows\System\crlZzay.exe
  2⤵
  PID:3224
- C:\Windows\System\caEOzKA.exe
  C:\Windows\System\caEOzKA.exe
  2⤵
  PID:3240
- C:\Windows\System\PAVNNvs.exe
  C:\Windows\System\PAVNNvs.exe
  2⤵
  PID:3256
- C:\Windows\System\ttMYRrg.exe
  C:\Windows\System\ttMYRrg.exe
  2⤵
  PID:3276
- C:\Windows\System\EjjelEp.exe
  C:\Windows\System\EjjelEp.exe
  2⤵
  PID:3292
- C:\Windows\System\XYjMwQF.exe
  C:\Windows\System\XYjMwQF.exe
  2⤵
  PID:3308
- C:\Windows\System\fLMommN.exe
  C:\Windows\System\fLMommN.exe
  2⤵
  PID:3324
- C:\Windows\System\FTwCGsk.exe
  C:\Windows\System\FTwCGsk.exe
  2⤵
  PID:3344
- C:\Windows\System\OMvzkVT.exe
  C:\Windows\System\OMvzkVT.exe
  2⤵
  PID:3360
- C:\Windows\System\tLqVvzY.exe
  C:\Windows\System\tLqVvzY.exe
  2⤵
  PID:3376
- C:\Windows\System\uYweeqh.exe
  C:\Windows\System\uYweeqh.exe
  2⤵
  PID:3392
- C:\Windows\System\zKIZwTr.exe
  C:\Windows\System\zKIZwTr.exe
  2⤵
  PID:3412
- C:\Windows\System\uDYHIeb.exe
  C:\Windows\System\uDYHIeb.exe
  2⤵
  PID:3428
- C:\Windows\System\tGcQkVF.exe
  C:\Windows\System\tGcQkVF.exe
  2⤵
  PID:3444
- C:\Windows\System\RDiuobf.exe
  C:\Windows\System\RDiuobf.exe
  2⤵
  PID:3464
- C:\Windows\System\EvveEXH.exe
  C:\Windows\System\EvveEXH.exe
  2⤵
  PID:3596
- C:\Windows\System\gILcXnh.exe
  C:\Windows\System\gILcXnh.exe
  2⤵
  PID:3612
- C:\Windows\System\lSYOeOC.exe
  C:\Windows\System\lSYOeOC.exe
  2⤵
  PID:3628
- C:\Windows\System\ypAUZNs.exe
  C:\Windows\System\ypAUZNs.exe
  2⤵
  PID:3644
- C:\Windows\System\rWjAPvH.exe
  C:\Windows\System\rWjAPvH.exe
  2⤵
  PID:3660
- C:\Windows\System\AXGwWKp.exe
  C:\Windows\System\AXGwWKp.exe
  2⤵
  PID:3676
- C:\Windows\System\LccxdLt.exe
  C:\Windows\System\LccxdLt.exe
  2⤵
  PID:3696
- C:\Windows\System\dZWyzjq.exe
  C:\Windows\System\dZWyzjq.exe
  2⤵
  PID:3712
- C:\Windows\System\LnfyXQc.exe
  C:\Windows\System\LnfyXQc.exe
  2⤵
  PID:3728
- C:\Windows\System\SEgdhIp.exe
  C:\Windows\System\SEgdhIp.exe
  2⤵
  PID:3744
- C:\Windows\System\fKeqPvN.exe
  C:\Windows\System\fKeqPvN.exe
  2⤵
  PID:3760
- C:\Windows\System\laVYNTA.exe
  C:\Windows\System\laVYNTA.exe
  2⤵
  PID:3780
- C:\Windows\System\AghWEZK.exe
  C:\Windows\System\AghWEZK.exe
  2⤵
  PID:3796
- C:\Windows\System\poSuIgs.exe
  C:\Windows\System\poSuIgs.exe
  2⤵
  PID:3812
- C:\Windows\System\zQOOVKi.exe
  C:\Windows\System\zQOOVKi.exe
  2⤵
  PID:3828
- C:\Windows\System\hTGuyTV.exe
  C:\Windows\System\hTGuyTV.exe
  2⤵
  PID:3884
- C:\Windows\System\NYNGZkO.exe
  C:\Windows\System\NYNGZkO.exe
  2⤵
  PID:3908
- C:\Windows\System\pohmYGV.exe
  C:\Windows\System\pohmYGV.exe
  2⤵
  PID:3936
- C:\Windows\System\AkOBfGr.exe
  C:\Windows\System\AkOBfGr.exe
  2⤵
  PID:3956
- C:\Windows\System\lRIMQVH.exe
  C:\Windows\System\lRIMQVH.exe
  2⤵
  PID:3976
- C:\Windows\System\wGJmwGO.exe
  C:\Windows\System\wGJmwGO.exe
  2⤵
  PID:3992
- C:\Windows\System\eFObNjm.exe
  C:\Windows\System\eFObNjm.exe
  2⤵
  PID:4016
- C:\Windows\System\yOrlxAW.exe
  C:\Windows\System\yOrlxAW.exe
  2⤵
  PID:4032
- C:\Windows\System\veyNCDW.exe
  C:\Windows\System\veyNCDW.exe
  2⤵
  PID:4056
- C:\Windows\System\yuQnhWb.exe
  C:\Windows\System\yuQnhWb.exe
  2⤵
  PID:4072
- C:\Windows\System\Lyfclnx.exe
  C:\Windows\System\Lyfclnx.exe
  2⤵
  PID:1600
- C:\Windows\System\uNlClRi.exe
  C:\Windows\System\uNlClRi.exe
  2⤵
  PID:2344
- C:\Windows\System\xNugroA.exe
  C:\Windows\System\xNugroA.exe
  2⤵
  PID:2388
- C:\Windows\System\JdwjaBV.exe
  C:\Windows\System\JdwjaBV.exe
  2⤵
  PID:3132
- C:\Windows\System\uQvDEuH.exe
  C:\Windows\System\uQvDEuH.exe
  2⤵
  PID:3204
- C:\Windows\System\DoedEhS.exe
  C:\Windows\System\DoedEhS.exe
  2⤵
  PID:3076
- C:\Windows\System\LNzgIaN.exe
  C:\Windows\System\LNzgIaN.exe
  2⤵
  PID:1996
- C:\Windows\System\qbIlyxu.exe
  C:\Windows\System\qbIlyxu.exe
  2⤵
  PID:1536
- C:\Windows\System\ofGPKvt.exe
  C:\Windows\System\ofGPKvt.exe
  2⤵
  PID:3156
- C:\Windows\System\GLuGdvS.exe
  C:\Windows\System\GLuGdvS.exe
  2⤵
  PID:3248
- C:\Windows\System\XwkdLul.exe
  C:\Windows\System\XwkdLul.exe
  2⤵
  PID:3424
- C:\Windows\System\hPPrQpS.exe
  C:\Windows\System\hPPrQpS.exe
  2⤵
  PID:3320
- C:\Windows\System\qLYiGJd.exe
  C:\Windows\System\qLYiGJd.exe
  2⤵
  PID:3336
- C:\Windows\System\NYINpUg.exe
  C:\Windows\System\NYINpUg.exe
  2⤵
  PID:3436
- C:\Windows\System\VzcAfZv.exe
  C:\Windows\System\VzcAfZv.exe
  2⤵
  PID:3492
- C:\Windows\System\HeIBZTi.exe
  C:\Windows\System\HeIBZTi.exe
  2⤵
  PID:3508
- C:\Windows\System\wFTmPoL.exe
  C:\Windows\System\wFTmPoL.exe
  2⤵
  PID:3128
- C:\Windows\System\CwHJfkH.exe
  C:\Windows\System\CwHJfkH.exe
  2⤵
  PID:3548
- C:\Windows\System\GcLoHAP.exe
  C:\Windows\System\GcLoHAP.exe
  2⤵
  PID:3272
- C:\Windows\System\OqFgyxq.exe
  C:\Windows\System\OqFgyxq.exe
  2⤵
  PID:3568
- C:\Windows\System\CSOOoZN.exe
  C:\Windows\System\CSOOoZN.exe
  2⤵
  PID:3588
- C:\Windows\System\Ruilzyk.exe
  C:\Windows\System\Ruilzyk.exe
  2⤵
  PID:3476
- C:\Windows\System\fifsWOI.exe
  C:\Windows\System\fifsWOI.exe
  2⤵
  PID:3652
- C:\Windows\System\lcIVdJg.exe
  C:\Windows\System\lcIVdJg.exe
  2⤵
  PID:3668
- C:\Windows\System\SHNKcSp.exe
  C:\Windows\System\SHNKcSp.exe
  2⤵
  PID:3836
- C:\Windows\System\CCsXTBU.exe
  C:\Windows\System\CCsXTBU.exe
  2⤵
  PID:3740
- C:\Windows\System\DeSgKeY.exe
  C:\Windows\System\DeSgKeY.exe
  2⤵
  PID:3808
- C:\Windows\System\PHTBCJG.exe
  C:\Windows\System\PHTBCJG.exe
  2⤵
  PID:3856
- C:\Windows\System\aiKUqZZ.exe
  C:\Windows\System\aiKUqZZ.exe
  2⤵
  PID:3872
- C:\Windows\System\FHBqXHs.exe
  C:\Windows\System\FHBqXHs.exe
  2⤵
  PID:3840
- C:\Windows\System\IMRFfvt.exe
  C:\Windows\System\IMRFfvt.exe
  2⤵
  PID:3916
- C:\Windows\System\EyqngWS.exe
  C:\Windows\System\EyqngWS.exe
  2⤵
  PID:3756
- C:\Windows\System\zdYrXwa.exe
  C:\Windows\System\zdYrXwa.exe
  2⤵
  PID:3964
- C:\Windows\System\ZPdcLMI.exe
  C:\Windows\System\ZPdcLMI.exe
  2⤵
  PID:3988
- C:\Windows\System\OVUDXyl.exe
  C:\Windows\System\OVUDXyl.exe
  2⤵
  PID:4004
- C:\Windows\System\HSxLeWP.exe
  C:\Windows\System\HSxLeWP.exe
  2⤵
  PID:4048
- C:\Windows\System\euKmgBA.exe
  C:\Windows\System\euKmgBA.exe
  2⤵
  PID:4068
- C:\Windows\System\REzHOxc.exe
  C:\Windows\System\REzHOxc.exe
  2⤵
  PID:4084
- C:\Windows\System\jLhHhyW.exe
  C:\Windows\System\jLhHhyW.exe
  2⤵
  PID:956
- C:\Windows\System\wvXvHoN.exe
  C:\Windows\System\wvXvHoN.exe
  2⤵
  PID:2684
- C:\Windows\System\YBQToEs.exe
  C:\Windows\System\YBQToEs.exe
  2⤵
  PID:3420
- C:\Windows\System\KipIHNS.exe
  C:\Windows\System\KipIHNS.exe
  2⤵
  PID:3236
- C:\Windows\System\rTMBSkx.exe
  C:\Windows\System\rTMBSkx.exe
  2⤵
  PID:3108
- C:\Windows\System\ACklyMY.exe
  C:\Windows\System\ACklyMY.exe
  2⤵
  PID:3188
- C:\Windows\System\zQspfhi.exe
  C:\Windows\System\zQspfhi.exe
  2⤵
  PID:3384
- C:\Windows\System\ABgDsdd.exe
  C:\Windows\System\ABgDsdd.exe
  2⤵
  PID:3460
- C:\Windows\System\yNYUuYV.exe
  C:\Windows\System\yNYUuYV.exe
  2⤵
  PID:3400
- C:\Windows\System\SIPtQrn.exe
  C:\Windows\System\SIPtQrn.exe
  2⤵
  PID:3484
- C:\Windows\System\TBNjLfu.exe
  C:\Windows\System\TBNjLfu.exe
  2⤵
  PID:3516
- C:\Windows\System\CPnmiaB.exe
  C:\Windows\System\CPnmiaB.exe
  2⤵
  PID:3556
- C:\Windows\System\vwyzegv.exe
  C:\Windows\System\vwyzegv.exe
  2⤵
  PID:3560
- C:\Windows\System\ClpTrJE.exe
  C:\Windows\System\ClpTrJE.exe
  2⤵
  PID:3576
- C:\Windows\System\icjLONN.exe
  C:\Windows\System\icjLONN.exe
  2⤵
  PID:3372
- C:\Windows\System\paCXTMm.exe
  C:\Windows\System\paCXTMm.exe
  2⤵
  PID:3608
- C:\Windows\System\KAfdxvM.exe
  C:\Windows\System\KAfdxvM.exe
  2⤵
  PID:3804
- C:\Windows\System\vfzcZZT.exe
  C:\Windows\System\vfzcZZT.exe
  2⤵
  PID:3736
- C:\Windows\System\Rwoddkl.exe
  C:\Windows\System\Rwoddkl.exe
  2⤵
  PID:3788
- C:\Windows\System\aySGjbg.exe
  C:\Windows\System\aySGjbg.exe
  2⤵
  PID:3724
- C:\Windows\System\CaaFDzN.exe
  C:\Windows\System\CaaFDzN.exe
  2⤵
  PID:3904
- C:\Windows\System\uahoXYW.exe
  C:\Windows\System\uahoXYW.exe
  2⤵
  PID:3948
- C:\Windows\System\sthdnKH.exe
  C:\Windows\System\sthdnKH.exe
  2⤵
  PID:3752
- C:\Windows\System\ClwmcAZ.exe
  C:\Windows\System\ClwmcAZ.exe
  2⤵
  PID:4104
- C:\Windows\System\swotcrf.exe
  C:\Windows\System\swotcrf.exe
  2⤵
  PID:4120
- C:\Windows\System\iBsuPRE.exe
  C:\Windows\System\iBsuPRE.exe
  2⤵
  PID:4136
- C:\Windows\System\QBuRNmJ.exe
  C:\Windows\System\QBuRNmJ.exe
  2⤵
  PID:4152
- C:\Windows\System\nZCLXDV.exe
  C:\Windows\System\nZCLXDV.exe
  2⤵
  PID:4172
- C:\Windows\System\kaRPfJY.exe
  C:\Windows\System\kaRPfJY.exe
  2⤵
  PID:4332
- C:\Windows\System\PJXnAtl.exe
  C:\Windows\System\PJXnAtl.exe
  2⤵
  PID:4368
- C:\Windows\System\wqssCSP.exe
  C:\Windows\System\wqssCSP.exe
  2⤵
  PID:4392
- C:\Windows\System\XYDarNO.exe
  C:\Windows\System\XYDarNO.exe
  2⤵
  PID:4408
- C:\Windows\System\CdoHriq.exe
  C:\Windows\System\CdoHriq.exe
  2⤵
  PID:4424
- C:\Windows\System\RgEreII.exe
  C:\Windows\System\RgEreII.exe
  2⤵
  PID:4440
- C:\Windows\System\SoKxWOI.exe
  C:\Windows\System\SoKxWOI.exe
  2⤵
  PID:4456
- C:\Windows\System\CtDgzYC.exe
  C:\Windows\System\CtDgzYC.exe
  2⤵
  PID:4472
- C:\Windows\System\doFbiso.exe
  C:\Windows\System\doFbiso.exe
  2⤵
  PID:4492
- C:\Windows\System\eWZVhZS.exe
  C:\Windows\System\eWZVhZS.exe
  2⤵
  PID:4508
- C:\Windows\System\cZhXnPr.exe
  C:\Windows\System\cZhXnPr.exe
  2⤵
  PID:4524
- C:\Windows\System\xWUKfEc.exe
  C:\Windows\System\xWUKfEc.exe
  2⤵
  PID:4540
- C:\Windows\System\VtDVyQA.exe
  C:\Windows\System\VtDVyQA.exe
  2⤵
  PID:4556
- C:\Windows\System\XFjJlbL.exe
  C:\Windows\System\XFjJlbL.exe
  2⤵
  PID:4572
- C:\Windows\System\mwZQWjS.exe
  C:\Windows\System\mwZQWjS.exe
  2⤵
  PID:4588
- C:\Windows\System\fcezUjK.exe
  C:\Windows\System\fcezUjK.exe
  2⤵
  PID:4632
- C:\Windows\System\rIVrYWd.exe
  C:\Windows\System\rIVrYWd.exe
  2⤵
  PID:4672
- C:\Windows\System\glgpMqB.exe
  C:\Windows\System\glgpMqB.exe
  2⤵
  PID:4688
- C:\Windows\System\TmiznbH.exe
  C:\Windows\System\TmiznbH.exe
  2⤵
  PID:4712
- C:\Windows\System\CTChQGS.exe
  C:\Windows\System\CTChQGS.exe
  2⤵
  PID:4732
- C:\Windows\System\vdJHiRe.exe
  C:\Windows\System\vdJHiRe.exe
  2⤵
  PID:4748
- C:\Windows\System\BEUAPQV.exe
  C:\Windows\System\BEUAPQV.exe
  2⤵
  PID:4764
- C:\Windows\System\AMQhgke.exe
  C:\Windows\System\AMQhgke.exe
  2⤵
  PID:4784
- C:\Windows\System\kVdSubT.exe
  C:\Windows\System\kVdSubT.exe
  2⤵
  PID:4800
- C:\Windows\System\tNtILyj.exe
  C:\Windows\System\tNtILyj.exe
  2⤵
  PID:4816
- C:\Windows\System\fIwRpDn.exe
  C:\Windows\System\fIwRpDn.exe
  2⤵
  PID:4832
- C:\Windows\System\PmhhGln.exe
  C:\Windows\System\PmhhGln.exe
  2⤵
  PID:4848
- C:\Windows\System\BPDdiZj.exe
  C:\Windows\System\BPDdiZj.exe
  2⤵
  PID:4868
- C:\Windows\System\ptcHIZn.exe
  C:\Windows\System\ptcHIZn.exe
  2⤵
  PID:4884
- C:\Windows\System\QqMtoNU.exe
  C:\Windows\System\QqMtoNU.exe
  2⤵
  PID:4900
- C:\Windows\System\fLICljF.exe
  C:\Windows\System\fLICljF.exe
  2⤵
  PID:4944
- C:\Windows\System\PfStepB.exe
  C:\Windows\System\PfStepB.exe
  2⤵
  PID:4992
- C:\Windows\System\fLTzsnj.exe
  C:\Windows\System\fLTzsnj.exe
  2⤵
  PID:5008
- C:\Windows\System\iQcQMBH.exe
  C:\Windows\System\iQcQMBH.exe
  2⤵
  PID:5048
- C:\Windows\System\uCRkHFy.exe
  C:\Windows\System\uCRkHFy.exe
  2⤵
  PID:5064
- C:\Windows\System\kiwkrNG.exe
  C:\Windows\System\kiwkrNG.exe
  2⤵
  PID:5080
- C:\Windows\System\iiIpnOJ.exe
  C:\Windows\System\iiIpnOJ.exe
  2⤵
  PID:5096
- C:\Windows\System\STngBVW.exe
  C:\Windows\System\STngBVW.exe
  2⤵
  PID:5116
- C:\Windows\System\WwzyJBk.exe
  C:\Windows\System\WwzyJBk.exe
  2⤵
  PID:3404
- C:\Windows\System\hGqzGeC.exe
  C:\Windows\System\hGqzGeC.exe
  2⤵
  PID:3544
- C:\Windows\System\WPTjYIu.exe
  C:\Windows\System\WPTjYIu.exe
  2⤵
  PID:3096
- C:\Windows\System\BblWRpZ.exe
  C:\Windows\System\BblWRpZ.exe
  2⤵
  PID:3456
- C:\Windows\System\PvqrRbt.exe
  C:\Windows\System\PvqrRbt.exe
  2⤵
  PID:4064
- C:\Windows\System\BgLtdSb.exe
  C:\Windows\System\BgLtdSb.exe
  2⤵
  PID:3944
- C:\Windows\System\PCDvbDX.exe
  C:\Windows\System\PCDvbDX.exe
  2⤵
  PID:3524
- C:\Windows\System\yKUaMqW.exe
  C:\Windows\System\yKUaMqW.exe
  2⤵
  PID:2040
- C:\Windows\System\MjYzypI.exe
  C:\Windows\System\MjYzypI.exe
  2⤵
  PID:3200
- C:\Windows\System\zHhEXUu.exe
  C:\Windows\System\zHhEXUu.exe
  2⤵
  PID:3332
- C:\Windows\System\JDAJGUj.exe
  C:\Windows\System\JDAJGUj.exe
  2⤵
  PID:3776
- C:\Windows\System\CeXnQTg.exe
  C:\Windows\System\CeXnQTg.exe
  2⤵
  PID:4100
- C:\Windows\System\QkfqIMT.exe
  C:\Windows\System\QkfqIMT.exe
  2⤵
  PID:3880
- C:\Windows\System\LLYAGQR.exe
  C:\Windows\System\LLYAGQR.exe
  2⤵
  PID:3792
- C:\Windows\System\daMzDzP.exe
  C:\Windows\System\daMzDzP.exe
  2⤵
  PID:4148
- C:\Windows\System\TNRfMHJ.exe
  C:\Windows\System\TNRfMHJ.exe
  2⤵
  PID:4192
- C:\Windows\System\XavzxIf.exe
  C:\Windows\System\XavzxIf.exe
  2⤵
  PID:4208
- C:\Windows\System\LPCHJvi.exe
  C:\Windows\System\LPCHJvi.exe
  2⤵
  PID:4220
- C:\Windows\System\ZrrQNgW.exe
  C:\Windows\System\ZrrQNgW.exe
  2⤵
  PID:4264
- C:\Windows\System\NsEeGHi.exe
  C:\Windows\System\NsEeGHi.exe
  2⤵
  PID:3124
- C:\Windows\System\TsfULvY.exe
  C:\Windows\System\TsfULvY.exe
  2⤵
  PID:4400
- C:\Windows\System\sdyNYzW.exe
  C:\Windows\System\sdyNYzW.exe
  2⤵
  PID:4468
- C:\Windows\System\ZCEYpgT.exe
  C:\Windows\System\ZCEYpgT.exe
  2⤵
  PID:4420
- C:\Windows\System\WEDsMDC.exe
  C:\Windows\System\WEDsMDC.exe
  2⤵
  PID:4532
- C:\Windows\System\zszjzam.exe
  C:\Windows\System\zszjzam.exe
  2⤵
  PID:4580
- C:\Windows\System\HwPtqJl.exe
  C:\Windows\System\HwPtqJl.exe
  2⤵
  PID:4604
- C:\Windows\System\GOoudUd.exe
  C:\Windows\System\GOoudUd.exe
  2⤵
  PID:4624
- C:\Windows\System\lLAQlzR.exe
  C:\Windows\System\lLAQlzR.exe
  2⤵
  PID:4548
- C:\Windows\System\ZEGsWwj.exe
  C:\Windows\System\ZEGsWwj.exe
  2⤵
  PID:4664
- C:\Windows\System\BDhBsee.exe
  C:\Windows\System\BDhBsee.exe
  2⤵
  PID:4696
- C:\Windows\System\LAhcvMt.exe
  C:\Windows\System\LAhcvMt.exe
  2⤵
  PID:4728
- C:\Windows\System\qGohGof.exe
  C:\Windows\System\qGohGof.exe
  2⤵
  PID:4856
- C:\Windows\System\eoNyqWR.exe
  C:\Windows\System\eoNyqWR.exe
  2⤵
  PID:4828
- C:\Windows\System\rmAujiA.exe
  C:\Windows\System\rmAujiA.exe
  2⤵
  PID:4744
- C:\Windows\System\RZJUVIC.exe
  C:\Windows\System\RZJUVIC.exe
  2⤵
  PID:4840
- C:\Windows\System\qqbztBE.exe
  C:\Windows\System\qqbztBE.exe
  2⤵
  PID:4740
- C:\Windows\System\DFtxUPY.exe
  C:\Windows\System\DFtxUPY.exe
  2⤵
  PID:4916
- C:\Windows\System\hZOSrxG.exe
  C:\Windows\System\hZOSrxG.exe
  2⤵
  PID:4936
- C:\Windows\System\SfhZSLr.exe
  C:\Windows\System\SfhZSLr.exe
  2⤵
  PID:4972
- C:\Windows\System\GEitFAE.exe
  C:\Windows\System\GEitFAE.exe
  2⤵
  PID:4988
- C:\Windows\System\nzJlqqz.exe
  C:\Windows\System\nzJlqqz.exe
  2⤵
  PID:5020
- C:\Windows\System\JeNuosG.exe
  C:\Windows\System\JeNuosG.exe
  2⤵
  PID:5036
- C:\Windows\System\UeHAijU.exe
  C:\Windows\System\UeHAijU.exe
  2⤵
  PID:3504
- C:\Windows\System\irzHCDz.exe
  C:\Windows\System\irzHCDz.exe
  2⤵
  PID:2252
- C:\Windows\System\KDgvBGp.exe
  C:\Windows\System\KDgvBGp.exe
  2⤵
  PID:3092
- C:\Windows\System\AZxNTfe.exe
  C:\Windows\System\AZxNTfe.exe
  2⤵
  PID:2012
- C:\Windows\System\clrOsRG.exe
  C:\Windows\System\clrOsRG.exe
  2⤵
  PID:3520
- C:\Windows\System\lRkZGZJ.exe
  C:\Windows\System\lRkZGZJ.exe
  2⤵
  PID:4144
- C:\Windows\System\IOJBaQn.exe
  C:\Windows\System\IOJBaQn.exe
  2⤵
  PID:4164
- C:\Windows\System\eoaIiPz.exe
  C:\Windows\System\eoaIiPz.exe
  2⤵
  PID:4204
- C:\Windows\System\FkoseaN.exe
  C:\Windows\System\FkoseaN.exe
  2⤵
  PID:3688
- C:\Windows\System\gInbgFL.exe
  C:\Windows\System\gInbgFL.exe
  2⤵
  PID:4216
- C:\Windows\System\HVTOcBy.exe
  C:\Windows\System\HVTOcBy.exe
  2⤵
  PID:3896
- C:\Windows\System\BJRdKQj.exe
  C:\Windows\System\BJRdKQj.exe
  2⤵
  PID:4256
- C:\Windows\System\SZnPFMB.exe
  C:\Windows\System\SZnPFMB.exe
  2⤵
  PID:4160
- C:\Windows\System\uMGBQyj.exe
  C:\Windows\System\uMGBQyj.exe
  2⤵
  PID:4252
- C:\Windows\System\pErkrtR.exe
  C:\Windows\System\pErkrtR.exe
  2⤵
  PID:4352
- C:\Windows\System\NRHeVea.exe
  C:\Windows\System\NRHeVea.exe
  2⤵
  PID:4356
- C:\Windows\System\psPQFLH.exe
  C:\Windows\System\psPQFLH.exe
  2⤵
  PID:4416
- C:\Windows\System\FsbOmGs.exe
  C:\Windows\System\FsbOmGs.exe
  2⤵
  PID:4452
- C:\Windows\System\NJVzrrJ.exe
  C:\Windows\System\NJVzrrJ.exe
  2⤵
  PID:4484
- C:\Windows\System\kjnsyeB.exe
  C:\Windows\System\kjnsyeB.exe
  2⤵
  PID:4612
- C:\Windows\System\wfcWBoy.exe
  C:\Windows\System\wfcWBoy.exe
  2⤵
  PID:4404
- C:\Windows\System\MpcLEMR.exe
  C:\Windows\System\MpcLEMR.exe
  2⤵
  PID:4644
- C:\Windows\System\JZUcZtX.exe
  C:\Windows\System\JZUcZtX.exe
  2⤵
  PID:4660
- C:\Windows\System\IqzEtHU.exe
  C:\Windows\System\IqzEtHU.exe
  2⤵
  PID:4708
- C:\Windows\System\hAQzCuU.exe
  C:\Windows\System\hAQzCuU.exe
  2⤵
  PID:4824
- C:\Windows\System\WRDGwmD.exe
  C:\Windows\System\WRDGwmD.exe
  2⤵
  PID:4808
- C:\Windows\System\DSfUOHx.exe
  C:\Windows\System\DSfUOHx.exe
  2⤵
  PID:4776
- C:\Windows\System\kOGWiRT.exe
  C:\Windows\System\kOGWiRT.exe
  2⤵
  PID:5044
- C:\Windows\System\rAzdqHy.exe
  C:\Windows\System\rAzdqHy.exe
  2⤵
  PID:5028
- C:\Windows\System\uoyAAKf.exe
  C:\Windows\System\uoyAAKf.exe
  2⤵
  PID:4928
- C:\Windows\System\qZtfeRk.exe
  C:\Windows\System\qZtfeRk.exe
  2⤵
  PID:5004
- C:\Windows\System\jaqTnft.exe
  C:\Windows\System\jaqTnft.exe
  2⤵
  PID:4964
- C:\Windows\System\VphAXWm.exe
  C:\Windows\System\VphAXWm.exe
  2⤵
  PID:5112
- C:\Windows\System\ozgbYVS.exe
  C:\Windows\System\ozgbYVS.exe
  2⤵
  PID:5124
- C:\Windows\System\Lfqqryr.exe
  C:\Windows\System\Lfqqryr.exe
  2⤵
  PID:5140
- C:\Windows\System\HNFWHRk.exe
  C:\Windows\System\HNFWHRk.exe
  2⤵
  PID:5156
- C:\Windows\System\dneoWBQ.exe
  C:\Windows\System\dneoWBQ.exe
  2⤵
  PID:5172
- C:\Windows\System\KKxaCid.exe
  C:\Windows\System\KKxaCid.exe
  2⤵
  PID:5188
- C:\Windows\System\jkDYXzB.exe
  C:\Windows\System\jkDYXzB.exe
  2⤵
  PID:5204
- C:\Windows\System\FtsChrc.exe
  C:\Windows\System\FtsChrc.exe
  2⤵
  PID:5340
- C:\Windows\System\FVstirO.exe
  C:\Windows\System\FVstirO.exe
  2⤵
  PID:5376
- C:\Windows\System\pOmzDvP.exe
  C:\Windows\System\pOmzDvP.exe
  2⤵
  PID:5392
- C:\Windows\System\GYIbENo.exe
  C:\Windows\System\GYIbENo.exe
  2⤵
  PID:5408
- C:\Windows\System\cAMFoon.exe
  C:\Windows\System\cAMFoon.exe
  2⤵
  PID:5436
- C:\Windows\System\ragpxHY.exe
  C:\Windows\System\ragpxHY.exe
  2⤵
  PID:5452
- C:\Windows\System\VFGkeKH.exe
  C:\Windows\System\VFGkeKH.exe
  2⤵
  PID:5468
- C:\Windows\System\iRzncRU.exe
  C:\Windows\System\iRzncRU.exe
  2⤵
  PID:5484
- C:\Windows\System\ovqYAbR.exe
  C:\Windows\System\ovqYAbR.exe
  2⤵
  PID:5500
- C:\Windows\System\nAIKSVF.exe
  C:\Windows\System\nAIKSVF.exe
  2⤵
  PID:5516
- C:\Windows\System\eLRsdUF.exe
  C:\Windows\System\eLRsdUF.exe
  2⤵
  PID:5536
- C:\Windows\System\xZbHApH.exe
  C:\Windows\System\xZbHApH.exe
  2⤵
  PID:5556
- C:\Windows\System\KQSLBeX.exe
  C:\Windows\System\KQSLBeX.exe
  2⤵
  PID:5572
- C:\Windows\System\QXNxlxg.exe
  C:\Windows\System\QXNxlxg.exe
  2⤵
  PID:5588
- C:\Windows\System\XssWmYm.exe
  C:\Windows\System\XssWmYm.exe
  2⤵
  PID:5604
- C:\Windows\System\FSWXSNS.exe
  C:\Windows\System\FSWXSNS.exe
  2⤵
  PID:5624
- C:\Windows\System\zcaHTmH.exe
  C:\Windows\System\zcaHTmH.exe
  2⤵
  PID:5640
- C:\Windows\System\sYjUUGp.exe
  C:\Windows\System\sYjUUGp.exe
  2⤵
  PID:5660
- C:\Windows\System\qhBjRwm.exe
  C:\Windows\System\qhBjRwm.exe
  2⤵
  PID:5676
- C:\Windows\System\BEUpYMZ.exe
  C:\Windows\System\BEUpYMZ.exe
  2⤵
  PID:5692
- C:\Windows\System\DAkjMuj.exe
  C:\Windows\System\DAkjMuj.exe
  2⤵
  PID:5712
- C:\Windows\System\EsPJLwV.exe
  C:\Windows\System\EsPJLwV.exe
  2⤵
  PID:5780
- C:\Windows\System\CkMjKkP.exe
  C:\Windows\System\CkMjKkP.exe
  2⤵
  PID:5796
- C:\Windows\System\FVwzmDv.exe
  C:\Windows\System\FVwzmDv.exe
  2⤵
  PID:5812
- C:\Windows\System\ZBJjfdR.exe
  C:\Windows\System\ZBJjfdR.exe
  2⤵
  PID:5828
- C:\Windows\System\zRnecyL.exe
  C:\Windows\System\zRnecyL.exe
  2⤵
  PID:5844
- C:\Windows\System\avhtcGA.exe
  C:\Windows\System\avhtcGA.exe
  2⤵
  PID:5860
- C:\Windows\System\XwRArIs.exe
  C:\Windows\System\XwRArIs.exe
  2⤵
  PID:5876
- C:\Windows\System\Ozkljxg.exe
  C:\Windows\System\Ozkljxg.exe
  2⤵
  PID:5892
- C:\Windows\System\UDMnbVU.exe
  C:\Windows\System\UDMnbVU.exe
  2⤵
  PID:5940
- C:\Windows\System\SqPHglF.exe
  C:\Windows\System\SqPHglF.exe
  2⤵
  PID:5956
- C:\Windows\System\zWCqFZh.exe
  C:\Windows\System\zWCqFZh.exe
  2⤵
  PID:5996
- C:\Windows\System\BZFhAei.exe
  C:\Windows\System\BZFhAei.exe
  2⤵
  PID:6012
- C:\Windows\System\qgCelwL.exe
  C:\Windows\System\qgCelwL.exe
  2⤵
  PID:6028
- C:\Windows\System\fzWnBdV.exe
  C:\Windows\System\fzWnBdV.exe
  2⤵
  PID:6044
- C:\Windows\System\ENLIOYi.exe
  C:\Windows\System\ENLIOYi.exe
  2⤵
  PID:6060
- C:\Windows\System\ICfZKHV.exe
  C:\Windows\System\ICfZKHV.exe
  2⤵
  PID:6092
- C:\Windows\System\WNlefsJ.exe
  C:\Windows\System\WNlefsJ.exe
  2⤵
  PID:6108
- C:\Windows\System\qGCqoUq.exe
  C:\Windows\System\qGCqoUq.exe
  2⤵
  PID:4012
- C:\Windows\System\FtdSvpD.exe
  C:\Windows\System\FtdSvpD.exe
  2⤵
  PID:4128
- C:\Windows\System\BUBfLhu.exe
  C:\Windows\System\BUBfLhu.exe
  2⤵
  PID:4296
- C:\Windows\System\oaSbEaP.exe
  C:\Windows\System\oaSbEaP.exe
  2⤵
  PID:4772
- C:\Windows\System\wTxkIYX.exe
  C:\Windows\System\wTxkIYX.exe
  2⤵
  PID:4616
- C:\Windows\System\ddLojLv.exe
  C:\Windows\System\ddLojLv.exe
  2⤵
  PID:4864
- C:\Windows\System\vbeoybK.exe
  C:\Windows\System\vbeoybK.exe
  2⤵
  PID:5152
- C:\Windows\System\hjdezXG.exe
  C:\Windows\System\hjdezXG.exe
  2⤵
  PID:5056
- C:\Windows\System\gIHjjdt.exe
  C:\Windows\System\gIHjjdt.exe
  2⤵
  PID:4268
- C:\Windows\System\wxiFRea.exe
  C:\Windows\System\wxiFRea.exe
  2⤵
  PID:3928
- C:\Windows\System\ASFNjKh.exe
  C:\Windows\System\ASFNjKh.exe
  2⤵
  PID:4236
- C:\Windows\System\Ouzgaje.exe
  C:\Windows\System\Ouzgaje.exe
  2⤵
  PID:4968
- C:\Windows\System\aFNukHC.exe
  C:\Windows\System\aFNukHC.exe
  2⤵
  PID:5148
- C:\Windows\System\MFdjKSq.exe
  C:\Windows\System\MFdjKSq.exe
  2⤵
  PID:5224
- C:\Windows\System\uqZmMos.exe
  C:\Windows\System\uqZmMos.exe
  2⤵
  PID:5240
- C:\Windows\System\DYcGOVr.exe
  C:\Windows\System\DYcGOVr.exe
  2⤵
  PID:5256
- C:\Windows\System\LXtyDqE.exe
  C:\Windows\System\LXtyDqE.exe
  2⤵
  PID:5276
- C:\Windows\System\SvKmwOL.exe
  C:\Windows\System\SvKmwOL.exe
  2⤵
  PID:5292
- C:\Windows\System\RnJnFJd.exe
  C:\Windows\System\RnJnFJd.exe
  2⤵
  PID:5308
- C:\Windows\System\GEEGQnS.exe
  C:\Windows\System\GEEGQnS.exe
  2⤵
  PID:5324
- C:\Windows\System\GHkfRnJ.exe
  C:\Windows\System\GHkfRnJ.exe
  2⤵
  PID:5216
- C:\Windows\System\krcMXXQ.exe
  C:\Windows\System\krcMXXQ.exe
  2⤵
  PID:5168
- C:\Windows\System\VmWTKjW.exe
  C:\Windows\System\VmWTKjW.exe
  2⤵
  PID:5136
- C:\Windows\System\VSfSVVH.exe
  C:\Windows\System\VSfSVVH.exe
  2⤵
  PID:5360
- C:\Windows\System\SoaPsTZ.exe
  C:\Windows\System\SoaPsTZ.exe
  2⤵
  PID:5388
- C:\Windows\System\WOggPSs.exe
  C:\Windows\System\WOggPSs.exe
  2⤵
  PID:5460
- C:\Windows\System\prcwlBi.exe
  C:\Windows\System\prcwlBi.exe
  2⤵
  PID:5600
- C:\Windows\System\DruXTQe.exe
  C:\Windows\System\DruXTQe.exe
  2⤵
  PID:5672
- C:\Windows\System\oitkchq.exe
  C:\Windows\System\oitkchq.exe
  2⤵
  PID:5552
- C:\Windows\System\llHZFFz.exe
  C:\Windows\System\llHZFFz.exe
  2⤵
  PID:5616
- C:\Windows\System\OmaAxxi.exe
  C:\Windows\System\OmaAxxi.exe
  2⤵
  PID:5656
- C:\Windows\System\lJJTxMs.exe
  C:\Windows\System\lJJTxMs.exe
  2⤵
  PID:5708
- C:\Windows\System\BBvKfIg.exe
  C:\Windows\System\BBvKfIg.exe
  2⤵
  PID:5752
- C:\Windows\System\AJpqbty.exe
  C:\Windows\System\AJpqbty.exe
  2⤵
  PID:5732
- C:\Windows\System\yGgAmMd.exe
  C:\Windows\System\yGgAmMd.exe
  2⤵
  PID:4384
- C:\Windows\System\waVYlpN.exe
  C:\Windows\System\waVYlpN.exe
  2⤵
  PID:5788
- C:\Windows\System\ShpDmyn.exe
  C:\Windows\System\ShpDmyn.exe
  2⤵
  PID:5852
- C:\Windows\System\RvKwJBQ.exe
  C:\Windows\System\RvKwJBQ.exe
  2⤵
  PID:5808
- C:\Windows\System\TvDNkLP.exe
  C:\Windows\System\TvDNkLP.exe
  2⤵
  PID:5836
- C:\Windows\System\pQiqcWt.exe
  C:\Windows\System\pQiqcWt.exe
  2⤵
  PID:5908
- C:\Windows\System\RXetQTF.exe
  C:\Windows\System\RXetQTF.exe
  2⤵
  PID:5924
- C:\Windows\System\rXMxTkp.exe
  C:\Windows\System\rXMxTkp.exe
  2⤵
  PID:5948
- C:\Windows\System\EGVKLkr.exe
  C:\Windows\System\EGVKLkr.exe
  2⤵
  PID:1000
- C:\Windows\System\twDaOSZ.exe
  C:\Windows\System\twDaOSZ.exe
  2⤵
  PID:6004
- C:\Windows\System\anrrVbf.exe
  C:\Windows\System\anrrVbf.exe
  2⤵
  PID:6036
- C:\Windows\System\FLGyMMh.exe
  C:\Windows\System\FLGyMMh.exe
  2⤵
  PID:6084
- C:\Windows\System\IZIvzvy.exe
  C:\Windows\System\IZIvzvy.exe
  2⤵
  PID:3704
- C:\Windows\System\lzhoqdF.exe
  C:\Windows\System\lzhoqdF.exe
  2⤵
  PID:4348
- C:\Windows\System\QJNafry.exe
  C:\Windows\System\QJNafry.exe
  2⤵
  PID:4920
- C:\Windows\System\HOPgugE.exe
  C:\Windows\System\HOPgugE.exe
  2⤵
  PID:4240
- C:\Windows\System\xOXCJXp.exe
  C:\Windows\System\xOXCJXp.exe
  2⤵
  PID:4656
- C:\Windows\System\KYtOAYG.exe
  C:\Windows\System\KYtOAYG.exe
  2⤵
  PID:4360
- C:\Windows\System\tqcusNO.exe
  C:\Windows\System\tqcusNO.exe
  2⤵
  PID:4536
- C:\Windows\System\UqjGPUX.exe
  C:\Windows\System\UqjGPUX.exe
  2⤵
  PID:4792
- C:\Windows\System\GbEhQIJ.exe
  C:\Windows\System\GbEhQIJ.exe
  2⤵
  PID:4080
- C:\Windows\System\roqdAnh.exe
  C:\Windows\System\roqdAnh.exe
  2⤵
  PID:5336
- C:\Windows\System\pJPWJkV.exe
  C:\Windows\System\pJPWJkV.exe
  2⤵
  PID:5372
- C:\Windows\System\qgPiZCi.exe
  C:\Windows\System\qgPiZCi.exe
  2⤵
  PID:4520
- C:\Windows\System\BZODlfO.exe
  C:\Windows\System\BZODlfO.exe
  2⤵
  PID:5528
- C:\Windows\System\MIBBPdd.exe
  C:\Windows\System\MIBBPdd.exe
  2⤵
  PID:5364
- C:\Windows\System\ikJgboR.exe
  C:\Windows\System\ikJgboR.exe
  2⤵
  PID:5532
- C:\Windows\System\uSBYuah.exe
  C:\Windows\System\uSBYuah.exe
  2⤵
  PID:5432
- C:\Windows\System\eZNMgyS.exe
  C:\Windows\System\eZNMgyS.exe
  2⤵
  PID:5252
- C:\Windows\System\szHerFg.exe
  C:\Windows\System\szHerFg.exe
  2⤵
  PID:5584
- C:\Windows\System\LRoFnuF.exe
  C:\Windows\System\LRoFnuF.exe
  2⤵
  PID:5748
- C:\Windows\System\RQJDUpz.exe
  C:\Windows\System\RQJDUpz.exe
  2⤵
  PID:5736
- C:\Windows\System\xoGTIYn.exe
  C:\Windows\System\xoGTIYn.exe
  2⤵
  PID:5804
- C:\Windows\System\sMXHrfw.exe
  C:\Windows\System\sMXHrfw.exe
  2⤵
  PID:5968
- C:\Windows\System\NJctwSM.exe
  C:\Windows\System\NJctwSM.exe
  2⤵
  PID:6080
- C:\Windows\System\dNPylma.exe
  C:\Windows\System\dNPylma.exe
  2⤵
  PID:5936
- C:\Windows\System\VKWvbEc.exe
  C:\Windows\System\VKWvbEc.exe
  2⤵
  PID:5888
- C:\Windows\System\RmpDLGQ.exe
  C:\Windows\System\RmpDLGQ.exe
  2⤵
  PID:6116
- C:\Windows\System\Irctllo.exe
  C:\Windows\System\Irctllo.exe
  2⤵
  PID:6132
- C:\Windows\System\xDcGLve.exe
  C:\Windows\System\xDcGLve.exe
  2⤵
  PID:6136
- C:\Windows\System\mTuBskr.exe
  C:\Windows\System\mTuBskr.exe
  2⤵
  PID:4184
- C:\Windows\System\XggLueU.exe
  C:\Windows\System\XggLueU.exe
  2⤵
  PID:3852
- C:\Windows\System\yAnNZlE.exe
  C:\Windows\System\yAnNZlE.exe
  2⤵
  PID:5060
- C:\Windows\System\aFuntrW.exe
  C:\Windows\System\aFuntrW.exe
  2⤵
  PID:3540
- C:\Windows\System\GhcKcMA.exe
  C:\Windows\System\GhcKcMA.exe
  2⤵
  PID:5268
- C:\Windows\System\prsfIqO.exe
  C:\Windows\System\prsfIqO.exe
  2⤵
  PID:5400
- C:\Windows\System\denPeIB.exe
  C:\Windows\System\denPeIB.exe
  2⤵
  PID:5320
- C:\Windows\System\KanFwDX.exe
  C:\Windows\System\KanFwDX.exe
  2⤵
  PID:5288
- C:\Windows\System\QnWdDko.exe
  C:\Windows\System\QnWdDko.exe
  2⤵
  PID:4844
- C:\Windows\System\wwZYcSB.exe
  C:\Windows\System\wwZYcSB.exe
  2⤵
  PID:5248
- C:\Windows\System\XtJmnij.exe
  C:\Windows\System\XtJmnij.exe
  2⤵
  PID:5368
- C:\Windows\System\WbYzlnh.exe
  C:\Windows\System\WbYzlnh.exe
  2⤵
  PID:5384
- C:\Windows\System\AtwptqV.exe
  C:\Windows\System\AtwptqV.exe
  2⤵
  PID:5476
- C:\Windows\System\LppvCoJ.exe
  C:\Windows\System\LppvCoJ.exe
  2⤵
  PID:5352
- C:\Windows\System\znaVkLW.exe
  C:\Windows\System\znaVkLW.exe
  2⤵
  PID:5768
- C:\Windows\System\MKtowpS.exe
  C:\Windows\System\MKtowpS.exe
  2⤵
  PID:6052
- C:\Windows\System\KLqesxL.exe
  C:\Windows\System\KLqesxL.exe
  2⤵
  PID:6124
- C:\Windows\System\SxbAGIW.exe
  C:\Windows\System\SxbAGIW.exe
  2⤵
  PID:5988
- C:\Windows\System\CJIkizv.exe
  C:\Windows\System\CJIkizv.exe
  2⤵
  PID:5448
- C:\Windows\System\lqUrNoT.exe
  C:\Windows\System\lqUrNoT.exe
  2⤵
  PID:5648
- C:\Windows\System\gqEbEPQ.exe
  C:\Windows\System\gqEbEPQ.exe
  2⤵
  PID:5424
- C:\Windows\System\FeNHbVh.exe
  C:\Windows\System\FeNHbVh.exe
  2⤵
  PID:5072
- C:\Windows\System\jXyeDBF.exe
  C:\Windows\System\jXyeDBF.exe
  2⤵
  PID:2680
- C:\Windows\System\hXaFGlV.exe
  C:\Windows\System\hXaFGlV.exe
  2⤵
  PID:4040
- C:\Windows\System\iisLOgG.exe
  C:\Windows\System\iisLOgG.exe
  2⤵
  PID:4908
- C:\Windows\System\bxdbgMG.exe
  C:\Windows\System\bxdbgMG.exe
  2⤵
  PID:5824
- C:\Windows\System\tOmqVEb.exe
  C:\Windows\System\tOmqVEb.exe
  2⤵
  PID:5900
- C:\Windows\System\WqnbRbp.exe
  C:\Windows\System\WqnbRbp.exe
  2⤵
  PID:5992
- C:\Windows\System\LVhKQZx.exe
  C:\Windows\System\LVhKQZx.exe
  2⤵
  PID:6088
- C:\Windows\System\MwvCwQk.exe
  C:\Windows\System\MwvCwQk.exe
  2⤵
  PID:5512
- C:\Windows\System\ZDOqRIU.exe
  C:\Windows\System\ZDOqRIU.exe
  2⤵
  PID:4504
- C:\Windows\System\QLCptAr.exe
  C:\Windows\System\QLCptAr.exe
  2⤵
  PID:6156
- C:\Windows\System\eGXCKdP.exe
  C:\Windows\System\eGXCKdP.exe
  2⤵
  PID:6172
- C:\Windows\System\rddKXtq.exe
  C:\Windows\System\rddKXtq.exe
  2⤵
  PID:6188
- C:\Windows\System\FDtmHsh.exe
  C:\Windows\System\FDtmHsh.exe
  2⤵
  PID:6204
- C:\Windows\System\lnSebyW.exe
  C:\Windows\System\lnSebyW.exe
  2⤵
  PID:6220
- C:\Windows\System\NFfnvFj.exe
  C:\Windows\System\NFfnvFj.exe
  2⤵
  PID:6240
- C:\Windows\System\FpcDXgD.exe
  C:\Windows\System\FpcDXgD.exe
  2⤵
  PID:6256
- C:\Windows\System\mPUfnVp.exe
  C:\Windows\System\mPUfnVp.exe
  2⤵
  PID:6272
- C:\Windows\System\JJyBABY.exe
  C:\Windows\System\JJyBABY.exe
  2⤵
  PID:6288
- C:\Windows\System\zXPfjAQ.exe
  C:\Windows\System\zXPfjAQ.exe
  2⤵
  PID:6304
- C:\Windows\System\jwtkzQO.exe
  C:\Windows\System\jwtkzQO.exe
  2⤵
  PID:6348
- C:\Windows\System\AUbTIMr.exe
  C:\Windows\System\AUbTIMr.exe
  2⤵
  PID:6364
- C:\Windows\System\bVIersO.exe
  C:\Windows\System\bVIersO.exe
  2⤵
  PID:6380
- C:\Windows\System\qCnsOHf.exe
  C:\Windows\System\qCnsOHf.exe
  2⤵
  PID:6396
- C:\Windows\System\dwgCNdn.exe
  C:\Windows\System\dwgCNdn.exe
  2⤵
  PID:6412
- C:\Windows\System\oTajVRi.exe
  C:\Windows\System\oTajVRi.exe
  2⤵
  PID:6428
- C:\Windows\System\EFLhzcc.exe
  C:\Windows\System\EFLhzcc.exe
  2⤵
  PID:6448
- C:\Windows\System\rHtqyfW.exe
  C:\Windows\System\rHtqyfW.exe
  2⤵
  PID:6464
- C:\Windows\System\HZnboEz.exe
  C:\Windows\System\HZnboEz.exe
  2⤵
  PID:6480
- C:\Windows\System\sUgAaRT.exe
  C:\Windows\System\sUgAaRT.exe
  2⤵
  PID:6496
- C:\Windows\System\tbZWZWh.exe
  C:\Windows\System\tbZWZWh.exe
  2⤵
  PID:6512
- C:\Windows\System\TSbnbPg.exe
  C:\Windows\System\TSbnbPg.exe
  2⤵
  PID:6528
- C:\Windows\System\GvqArqo.exe
  C:\Windows\System\GvqArqo.exe
  2⤵
  PID:6548
- C:\Windows\System\tppCQeA.exe
  C:\Windows\System\tppCQeA.exe
  2⤵
  PID:6564
- C:\Windows\System\cyggymC.exe
  C:\Windows\System\cyggymC.exe
  2⤵
  PID:6580
- C:\Windows\System\bEZAQlf.exe
  C:\Windows\System\bEZAQlf.exe
  2⤵
  PID:6596
- C:\Windows\System\dsxCuvc.exe
  C:\Windows\System\dsxCuvc.exe
  2⤵
  PID:6612
- C:\Windows\System\htHSxdL.exe
  C:\Windows\System\htHSxdL.exe
  2⤵
  PID:6628
- C:\Windows\System\fVBxzMV.exe
  C:\Windows\System\fVBxzMV.exe
  2⤵
  PID:6644
- C:\Windows\System\vXhOSmN.exe
  C:\Windows\System\vXhOSmN.exe
  2⤵
  PID:6660
- C:\Windows\System\cbynkiw.exe
  C:\Windows\System\cbynkiw.exe
  2⤵
  PID:6676
- C:\Windows\System\SXggdYT.exe
  C:\Windows\System\SXggdYT.exe
  2⤵
  PID:6692
- C:\Windows\System\WUSnGVc.exe
  C:\Windows\System\WUSnGVc.exe
  2⤵
  PID:6712
- C:\Windows\System\lhheoIN.exe
  C:\Windows\System\lhheoIN.exe
  2⤵
  PID:6732
- C:\Windows\System\lnffFcu.exe
  C:\Windows\System\lnffFcu.exe
  2⤵
  PID:6748
- C:\Windows\System\xCRkPgU.exe
  C:\Windows\System\xCRkPgU.exe
  2⤵
  PID:6764
- C:\Windows\System\qCtBrHb.exe
  C:\Windows\System\qCtBrHb.exe
  2⤵
  PID:6780
- C:\Windows\System\OSbaMwK.exe
  C:\Windows\System\OSbaMwK.exe
  2⤵
  PID:6796
- C:\Windows\System\fMJPftn.exe
  C:\Windows\System\fMJPftn.exe
  2⤵
  PID:6812
- C:\Windows\System\AaDNgty.exe
  C:\Windows\System\AaDNgty.exe
  2⤵
  PID:6828
- C:\Windows\System\oNYYwZq.exe
  C:\Windows\System\oNYYwZq.exe
  2⤵
  PID:6844
- C:\Windows\System\cNJcAjA.exe
  C:\Windows\System\cNJcAjA.exe
  2⤵
  PID:6860
- C:\Windows\System\rRJtbLg.exe
  C:\Windows\System\rRJtbLg.exe
  2⤵
  PID:6876
- C:\Windows\System\QaOxuOP.exe
  C:\Windows\System\QaOxuOP.exe
  2⤵
  PID:6892
- C:\Windows\System\OEpYqqq.exe
  C:\Windows\System\OEpYqqq.exe
  2⤵
  PID:6908
- C:\Windows\System\FjxuqpT.exe
  C:\Windows\System\FjxuqpT.exe
  2⤵
  PID:6924
- C:\Windows\System\xdbsogs.exe
  C:\Windows\System\xdbsogs.exe
  2⤵
  PID:6940
- C:\Windows\System\ZuURQpa.exe
  C:\Windows\System\ZuURQpa.exe
  2⤵
  PID:6956
- C:\Windows\System\BoGfOKi.exe
  C:\Windows\System\BoGfOKi.exe
  2⤵
  PID:6972
- C:\Windows\System\sOTjCYh.exe
  C:\Windows\System\sOTjCYh.exe
  2⤵
  PID:6988
- C:\Windows\System\ZgCidHC.exe
  C:\Windows\System\ZgCidHC.exe
  2⤵
  PID:7004
- C:\Windows\System\fGskOSK.exe
  C:\Windows\System\fGskOSK.exe
  2⤵
  PID:7020
- C:\Windows\System\fjgsQGT.exe
  C:\Windows\System\fjgsQGT.exe
  2⤵
  PID:7036
- C:\Windows\System\VNqGbGr.exe
  C:\Windows\System\VNqGbGr.exe
  2⤵
  PID:7056
- C:\Windows\System\YKaISix.exe
  C:\Windows\System\YKaISix.exe
  2⤵
  PID:7076
- C:\Windows\System\hxrEqdm.exe
  C:\Windows\System\hxrEqdm.exe
  2⤵
  PID:7092
- C:\Windows\System\ikboHaG.exe
  C:\Windows\System\ikboHaG.exe
  2⤵
  PID:7108
- C:\Windows\System\yvFryqb.exe
  C:\Windows\System\yvFryqb.exe
  2⤵
  PID:7124
- C:\Windows\System\CtDAtxC.exe
  C:\Windows\System\CtDAtxC.exe
  2⤵
  PID:7140
- C:\Windows\System\rlzZkDV.exe
  C:\Windows\System\rlzZkDV.exe
  2⤵
  PID:7156
- C:\Windows\System\RlaUMFe.exe
  C:\Windows\System\RlaUMFe.exe
  2⤵
  PID:6068
- C:\Windows\System\mGqHxgt.exe
  C:\Windows\System\mGqHxgt.exe
  2⤵
  PID:6072
- C:\Windows\System\fbgFBeJ.exe
  C:\Windows\System\fbgFBeJ.exe
  2⤵
  PID:5652
- C:\Windows\System\hEhseYk.exe
  C:\Windows\System\hEhseYk.exe
  2⤵
  PID:6284
- C:\Windows\System\oFgaBsi.exe
  C:\Windows\System\oFgaBsi.exe
  2⤵
  PID:6216
- C:\Windows\System\RxLokhD.exe
  C:\Windows\System\RxLokhD.exe
  2⤵
  PID:6148
- C:\Windows\System\Kmebria.exe
  C:\Windows\System\Kmebria.exe
  2⤵
  PID:5904
- C:\Windows\System\LOTZSRq.exe
  C:\Windows\System\LOTZSRq.exe
  2⤵
  PID:6320
- C:\Windows\System\rQMWcUv.exe
  C:\Windows\System\rQMWcUv.exe
  2⤵
  PID:6336
- C:\Windows\System\sYmXswu.exe
  C:\Windows\System\sYmXswu.exe
  2⤵
  PID:6164
- C:\Windows\System\UynNQiT.exe
  C:\Windows\System\UynNQiT.exe
  2⤵
  PID:6340
- C:\Windows\System\qJsKKhQ.exe
  C:\Windows\System\qJsKKhQ.exe
  2⤵
  PID:6264
- C:\Windows\System\hbVqLfu.exe
  C:\Windows\System\hbVqLfu.exe
  2⤵
  PID:5420
- C:\Windows\System\BlxlTsc.exe
  C:\Windows\System\BlxlTsc.exe
  2⤵
  PID:6424
- C:\Windows\System\FZIvaTR.exe
  C:\Windows\System\FZIvaTR.exe
  2⤵
  PID:6460
- C:\Windows\System\yEaPeJO.exe
  C:\Windows\System\yEaPeJO.exe
  2⤵
  PID:6556
- C:\Windows\System\bwLselR.exe
  C:\Windows\System\bwLselR.exe
  2⤵
  PID:6376
- C:\Windows\System\AnHSVek.exe
  C:\Windows\System\AnHSVek.exe
  2⤵
  PID:6592
- C:\Windows\System\XayWEbE.exe
  C:\Windows\System\XayWEbE.exe
  2⤵
  PID:6656
- C:\Windows\System\tLTqUgC.exe
  C:\Windows\System\tLTqUgC.exe
  2⤵
  PID:6728
- C:\Windows\System\ZVFVaWd.exe
  C:\Windows\System\ZVFVaWd.exe
  2⤵
  PID:6440
- C:\Windows\System\BNfwdhW.exe
  C:\Windows\System\BNfwdhW.exe
  2⤵
  PID:6536
- C:\Windows\System\cXTdQSW.exe
  C:\Windows\System\cXTdQSW.exe
  2⤵
  PID:6576
- C:\Windows\System\xfzEaCc.exe
  C:\Windows\System\xfzEaCc.exe
  2⤵
  PID:6668
- C:\Windows\System\pZIFchZ.exe
  C:\Windows\System\pZIFchZ.exe
  2⤵
  PID:6708
- C:\Windows\System\gHdFYYp.exe
  C:\Windows\System\gHdFYYp.exe
  2⤵
  PID:6760
- C:\Windows\System\jvJrVgj.exe
  C:\Windows\System\jvJrVgj.exe
  2⤵
  PID:6852
- C:\Windows\System\wGbUFlb.exe
  C:\Windows\System\wGbUFlb.exe
  2⤵
  PID:6888
- C:\Windows\System\SiTAxfm.exe
  C:\Windows\System\SiTAxfm.exe
  2⤵
  PID:6952
- C:\Windows\System\uJqfYkg.exe
  C:\Windows\System\uJqfYkg.exe
  2⤵
  PID:7016
- C:\Windows\System\PMWdHyd.exe
  C:\Windows\System\PMWdHyd.exe
  2⤵
  PID:6968
- C:\Windows\System\xcyCHYl.exe
  C:\Windows\System\xcyCHYl.exe
  2⤵
  PID:6776
- C:\Windows\System\WPOGjxw.exe
  C:\Windows\System\WPOGjxw.exe
  2⤵
  PID:7084
- C:\Windows\System\jHtlVtl.exe
  C:\Windows\System\jHtlVtl.exe
  2⤵
  PID:6840
- C:\Windows\System\mfPGeXP.exe
  C:\Windows\System\mfPGeXP.exe
  2⤵
  PID:7028
- C:\Windows\System\VIRdulr.exe
  C:\Windows\System\VIRdulr.exe
  2⤵
  PID:7116
- C:\Windows\System\hPkDKwA.exe
  C:\Windows\System\hPkDKwA.exe
  2⤵
  PID:7136
- C:\Windows\System\MXqlccj.exe
  C:\Windows\System\MXqlccj.exe
  2⤵
  PID:6104
- C:\Windows\System\tjhGPRh.exe
  C:\Windows\System\tjhGPRh.exe
  2⤵
  PID:6152
- C:\Windows\System\OHHTzfG.exe
  C:\Windows\System\OHHTzfG.exe
  2⤵
  PID:6296
- C:\Windows\System\iXShdJo.exe
  C:\Windows\System\iXShdJo.exe
  2⤵
  PID:6360
- C:\Windows\System\iCXdhdS.exe
  C:\Windows\System\iCXdhdS.exe
  2⤵
  PID:6520
- C:\Windows\System\MwGweoG.exe
  C:\Windows\System\MwGweoG.exe
  2⤵
  PID:6020
- C:\Windows\System\cDVQAMY.exe
  C:\Windows\System\cDVQAMY.exe
  2⤵
  PID:6508
- C:\Windows\System\OqJWdwX.exe
  C:\Windows\System\OqJWdwX.exe
  2⤵
  PID:6248
- C:\Windows\System\hzDeUks.exe
  C:\Windows\System\hzDeUks.exe
  2⤵
  PID:6744
- C:\Windows\System\MyuHBUg.exe
  C:\Windows\System\MyuHBUg.exe
  2⤵
  PID:6328
- C:\Windows\System\XiPXnfx.exe
  C:\Windows\System\XiPXnfx.exe
  2⤵
  PID:6652
- C:\Windows\System\OdVbvXb.exe
  C:\Windows\System\OdVbvXb.exe
  2⤵
  PID:6200
- C:\Windows\System\VMfeUFq.exe
  C:\Windows\System\VMfeUFq.exe
  2⤵
  PID:6544
- C:\Windows\System\ytBEkJC.exe
  C:\Windows\System\ytBEkJC.exe
  2⤵
  PID:7088
- C:\Windows\System\kCQOPyL.exe
  C:\Windows\System\kCQOPyL.exe
  2⤵
  PID:6236
- C:\Windows\System\CFLaxGM.exe
  C:\Windows\System\CFLaxGM.exe
  2⤵
  PID:6504
- C:\Windows\System\XnRlbCv.exe
  C:\Windows\System\XnRlbCv.exe
  2⤵
  PID:6640
- C:\Windows\System\GAntSBO.exe
  C:\Windows\System\GAntSBO.exe
  2⤵
  PID:5972
- C:\Windows\System\IOHYPRM.exe
  C:\Windows\System\IOHYPRM.exe
  2⤵
  PID:7052
- C:\Windows\System\eaRuqCf.exe
  C:\Windows\System\eaRuqCf.exe
  2⤵
  PID:6820
- C:\Windows\System\NXZskJR.exe
  C:\Windows\System\NXZskJR.exe
  2⤵
  PID:4684
- C:\Windows\System\vVvUuFb.exe
  C:\Windows\System\vVvUuFb.exe
  2⤵
  PID:3580
- C:\Windows\System\ZrvjZfT.exe
  C:\Windows\System\ZrvjZfT.exe
  2⤵
  PID:7012
- C:\Windows\System\hEsagwG.exe
  C:\Windows\System\hEsagwG.exe
  2⤵
  PID:6404
- C:\Windows\System\fotUBTU.exe
  C:\Windows\System\fotUBTU.exe
  2⤵
  PID:7132
- C:\Windows\System\HFrOShD.exe
  C:\Windows\System\HFrOShD.exe
  2⤵
  PID:7104
- C:\Windows\System\wEsjRvi.exe
  C:\Windows\System\wEsjRvi.exe
  2⤵
  PID:6964
- C:\Windows\System\gIEOOUH.exe
  C:\Windows\System\gIEOOUH.exe
  2⤵
  PID:6476
- C:\Windows\System\ENMrzPb.exe
  C:\Windows\System\ENMrzPb.exe
  2⤵
  PID:6704
- C:\Windows\System\NwRhYlg.exe
  C:\Windows\System\NwRhYlg.exe
  2⤵
  PID:6196
- C:\Windows\System\rFRQJnD.exe
  C:\Windows\System\rFRQJnD.exe
  2⤵
  PID:7152
- C:\Windows\System\rCKSpVP.exe
  C:\Windows\System\rCKSpVP.exe
  2⤵
  PID:6904
- C:\Windows\System\WORLJoP.exe
  C:\Windows\System\WORLJoP.exe
  2⤵
  PID:6984
- C:\Windows\System\ascaPOK.exe
  C:\Windows\System\ascaPOK.exe
  2⤵
  PID:6436
- C:\Windows\System\hEyHmep.exe
  C:\Windows\System\hEyHmep.exe
  2⤵
  PID:6524
- C:\Windows\System\eugVtMb.exe
  C:\Windows\System\eugVtMb.exe
  2⤵
  PID:7064
- C:\Windows\System\DNaKygL.exe
  C:\Windows\System\DNaKygL.exe
  2⤵
  PID:6492
- C:\Windows\System\vpmHqmR.exe
  C:\Windows\System\vpmHqmR.exe
  2⤵
  PID:5508
- C:\Windows\System\LcTXVfU.exe
  C:\Windows\System\LcTXVfU.exe
  2⤵
  PID:6312
- C:\Windows\System\cjtGTSW.exe
  C:\Windows\System\cjtGTSW.exe
  2⤵
  PID:7184
- C:\Windows\System\FvelDPc.exe
  C:\Windows\System\FvelDPc.exe
  2⤵
  PID:7200
- C:\Windows\System\UmkEnpF.exe
  C:\Windows\System\UmkEnpF.exe
  2⤵
  PID:7216
- C:\Windows\System\zjJYdVX.exe
  C:\Windows\System\zjJYdVX.exe
  2⤵
  PID:7232
- C:\Windows\System\AAIAoyQ.exe
  C:\Windows\System\AAIAoyQ.exe
  2⤵
  PID:7248
- C:\Windows\System\OHyBKOW.exe
  C:\Windows\System\OHyBKOW.exe
  2⤵
  PID:7264
- C:\Windows\System\DHcbcfH.exe
  C:\Windows\System\DHcbcfH.exe
  2⤵
  PID:7284
- C:\Windows\System\anmKPXr.exe
  C:\Windows\System\anmKPXr.exe
  2⤵
  PID:7300
- C:\Windows\System\ZkuoZCA.exe
  C:\Windows\System\ZkuoZCA.exe
  2⤵
  PID:7316
- C:\Windows\System\xsCXYri.exe
  C:\Windows\System\xsCXYri.exe
  2⤵
  PID:7332
- C:\Windows\System\pthKPTg.exe
  C:\Windows\System\pthKPTg.exe
  2⤵
  PID:7348
- C:\Windows\System\dQPTgTm.exe
  C:\Windows\System\dQPTgTm.exe
  2⤵
  PID:7364
- C:\Windows\System\KsUKxCd.exe
  C:\Windows\System\KsUKxCd.exe
  2⤵
  PID:7380
- C:\Windows\System\rSMfNFw.exe
  C:\Windows\System\rSMfNFw.exe
  2⤵
  PID:7396
- C:\Windows\System\wlEMLLk.exe
  C:\Windows\System\wlEMLLk.exe
  2⤵
  PID:7412
- C:\Windows\System\kOgwtua.exe
  C:\Windows\System\kOgwtua.exe
  2⤵
  PID:7428
- C:\Windows\System\TVHhtBl.exe
  C:\Windows\System\TVHhtBl.exe
  2⤵
  PID:7444
- C:\Windows\System\yLNXmGN.exe
  C:\Windows\System\yLNXmGN.exe
  2⤵
  PID:7460
- C:\Windows\System\KABXnrV.exe
  C:\Windows\System\KABXnrV.exe
  2⤵
  PID:7476
- C:\Windows\System\bddeWQE.exe
  C:\Windows\System\bddeWQE.exe
  2⤵
  PID:7492
- C:\Windows\System\eFwpLYU.exe
  C:\Windows\System\eFwpLYU.exe
  2⤵
  PID:7508
- C:\Windows\System\vuwDaFG.exe
  C:\Windows\System\vuwDaFG.exe
  2⤵
  PID:7524
- C:\Windows\System\DVEhZZT.exe
  C:\Windows\System\DVEhZZT.exe
  2⤵
  PID:7540
- C:\Windows\System\hRVoBRO.exe
  C:\Windows\System\hRVoBRO.exe
  2⤵
  PID:7556
- C:\Windows\System\YNerXfb.exe
  C:\Windows\System\YNerXfb.exe
  2⤵
  PID:7572
- C:\Windows\System\JWRRelZ.exe
  C:\Windows\System\JWRRelZ.exe
  2⤵
  PID:7588
- C:\Windows\System\KXANgcn.exe
  C:\Windows\System\KXANgcn.exe
  2⤵
  PID:7604
- C:\Windows\System\TCGhLXi.exe
  C:\Windows\System\TCGhLXi.exe
  2⤵
  PID:7620
- C:\Windows\System\MpRWFyd.exe
  C:\Windows\System\MpRWFyd.exe
  2⤵
  PID:7636
- C:\Windows\System\stqwwXh.exe
  C:\Windows\System\stqwwXh.exe
  2⤵
  PID:7652
- C:\Windows\System\smzYnsg.exe
  C:\Windows\System\smzYnsg.exe
  2⤵
  PID:7668
- C:\Windows\System\GgFBkiJ.exe
  C:\Windows\System\GgFBkiJ.exe
  2⤵
  PID:7684
- C:\Windows\System\rejcvnC.exe
  C:\Windows\System\rejcvnC.exe
  2⤵
  PID:7704
- C:\Windows\System\sBOUvEU.exe
  C:\Windows\System\sBOUvEU.exe
  2⤵
  PID:7720
- C:\Windows\System\uTmvCbY.exe
  C:\Windows\System\uTmvCbY.exe
  2⤵
  PID:7736
- C:\Windows\System\NMQBIUx.exe
  C:\Windows\System\NMQBIUx.exe
  2⤵
  PID:7752
- C:\Windows\System\fsLPqbQ.exe
  C:\Windows\System\fsLPqbQ.exe
  2⤵
  PID:7768
- C:\Windows\System\ELZaXqU.exe
  C:\Windows\System\ELZaXqU.exe
  2⤵
  PID:7784
- C:\Windows\System\iDfcsvy.exe
  C:\Windows\System\iDfcsvy.exe
  2⤵
  PID:7800
- C:\Windows\System\UeeqZOb.exe
  C:\Windows\System\UeeqZOb.exe
  2⤵
  PID:7816
- C:\Windows\System\KFgpyUE.exe
  C:\Windows\System\KFgpyUE.exe
  2⤵
  PID:7832
- C:\Windows\System\fgKRETK.exe
  C:\Windows\System\fgKRETK.exe
  2⤵
  PID:7848
- C:\Windows\System\UpWbXdr.exe
  C:\Windows\System\UpWbXdr.exe
  2⤵
  PID:7864
- C:\Windows\System\LtyXxFP.exe
  C:\Windows\System\LtyXxFP.exe
  2⤵
  PID:7880
- C:\Windows\System\qpxqLZj.exe
  C:\Windows\System\qpxqLZj.exe
  2⤵
  PID:7896
- C:\Windows\System\gnrKuZN.exe
  C:\Windows\System\gnrKuZN.exe
  2⤵
  PID:7912
- C:\Windows\System\Zakkozb.exe
  C:\Windows\System\Zakkozb.exe
  2⤵
  PID:7932
- C:\Windows\System\CjdLejJ.exe
  C:\Windows\System\CjdLejJ.exe
  2⤵
  PID:7948
- C:\Windows\System\MeWUTSX.exe
  C:\Windows\System\MeWUTSX.exe
  2⤵
  PID:7968
- C:\Windows\System\iKcLDPR.exe
  C:\Windows\System\iKcLDPR.exe
  2⤵
  PID:7984
- C:\Windows\System\FKxiqUQ.exe
  C:\Windows\System\FKxiqUQ.exe
  2⤵
  PID:8000
- C:\Windows\System\kIldHbo.exe
  C:\Windows\System\kIldHbo.exe
  2⤵
  PID:8020
- C:\Windows\System\FZYdXrh.exe
  C:\Windows\System\FZYdXrh.exe
  2⤵
  PID:8036
- C:\Windows\System\trWDGfQ.exe
  C:\Windows\System\trWDGfQ.exe
  2⤵
  PID:8052
- C:\Windows\System\mUWwzFe.exe
  C:\Windows\System\mUWwzFe.exe
  2⤵
  PID:8068
- C:\Windows\System\hOMegkv.exe
  C:\Windows\System\hOMegkv.exe
  2⤵
  PID:8084
- C:\Windows\System\tNoVDjr.exe
  C:\Windows\System\tNoVDjr.exe
  2⤵
  PID:8100
- C:\Windows\System\XLttpxH.exe
  C:\Windows\System\XLttpxH.exe
  2⤵
  PID:8116
- C:\Windows\System\czZnZdH.exe
  C:\Windows\System\czZnZdH.exe
  2⤵
  PID:8136
- C:\Windows\System\FwsdzAL.exe
  C:\Windows\System\FwsdzAL.exe
  2⤵
  PID:8152
- C:\Windows\System\msaFVKh.exe
  C:\Windows\System\msaFVKh.exe
  2⤵
  PID:8168
- C:\Windows\System\tNBFBAb.exe
  C:\Windows\System\tNBFBAb.exe
  2⤵
  PID:8184
- C:\Windows\System\szRZiWG.exe
  C:\Windows\System\szRZiWG.exe
  2⤵
  PID:7192
- C:\Windows\System\NztZmRL.exe
  C:\Windows\System\NztZmRL.exe
  2⤵
  PID:7256
- C:\Windows\System\vqgCQag.exe
  C:\Windows\System\vqgCQag.exe
  2⤵
  PID:7244
- C:\Windows\System\eKRbioM.exe
  C:\Windows\System\eKRbioM.exe
  2⤵
  PID:7240
- C:\Windows\System\QYzfkxJ.exe
  C:\Windows\System\QYzfkxJ.exe
  2⤵
  PID:5164
- C:\Windows\System\rMsPRrq.exe
  C:\Windows\System\rMsPRrq.exe
  2⤵
  PID:7328
- C:\Windows\System\CQXNNdn.exe
  C:\Windows\System\CQXNNdn.exe
  2⤵
  PID:7360
- C:\Windows\System\DtWbjfT.exe
  C:\Windows\System\DtWbjfT.exe
  2⤵
  PID:7420
- C:\Windows\System\LiOSJOs.exe
  C:\Windows\System\LiOSJOs.exe
  2⤵
  PID:7424
- C:\Windows\System\FkLcAco.exe
  C:\Windows\System\FkLcAco.exe
  2⤵
  PID:7484
- C:\Windows\System\oFbqGVG.exe
  C:\Windows\System\oFbqGVG.exe
  2⤵
  PID:7516
- C:\Windows\System\ifsDyuS.exe
  C:\Windows\System\ifsDyuS.exe
  2⤵
  PID:7504
- C:\Windows\System\cYJgaSj.exe
  C:\Windows\System\cYJgaSj.exe
  2⤵
  PID:7436
- C:\Windows\System\IsmyuOr.exe
  C:\Windows\System\IsmyuOr.exe
  2⤵
  PID:7532
- C:\Windows\System\svnlead.exe
  C:\Windows\System\svnlead.exe
  2⤵
  PID:7612
- C:\Windows\System\uznJLYs.exe
  C:\Windows\System\uznJLYs.exe
  2⤵
  PID:7660
- C:\Windows\System\DBXeHmn.exe
  C:\Windows\System\DBXeHmn.exe
  2⤵
  PID:7628
- C:\Windows\System\JUuBoGG.exe
  C:\Windows\System\JUuBoGG.exe
  2⤵
  PID:7692
- C:\Windows\System\MrSMmwB.exe
  C:\Windows\System\MrSMmwB.exe
  2⤵
  PID:7716
- C:\Windows\System\rByBcrO.exe
  C:\Windows\System\rByBcrO.exe
  2⤵
  PID:7780
- C:\Windows\System\PhuWXvG.exe
  C:\Windows\System\PhuWXvG.exe
  2⤵
  PID:7872
- C:\Windows\System\xZsaWMq.exe
  C:\Windows\System\xZsaWMq.exe
  2⤵
  PID:7908
- C:\Windows\System\krVWaqX.exe
  C:\Windows\System\krVWaqX.exe
  2⤵
  PID:7760
- C:\Windows\System\iTkBcZZ.exe
  C:\Windows\System\iTkBcZZ.exe
  2⤵
  PID:7824
- C:\Windows\System\YaSgZjV.exe
  C:\Windows\System\YaSgZjV.exe
  2⤵
  PID:7892
- C:\Windows\System\ynKRHcm.exe
  C:\Windows\System\ynKRHcm.exe
  2⤵
  PID:7960
- C:\Windows\System\eWhCdDM.exe
  C:\Windows\System\eWhCdDM.exe
  2⤵
  PID:8112
- C:\Windows\System\vdeXYiw.exe
  C:\Windows\System\vdeXYiw.exe
  2⤵
  PID:7980
- C:\Windows\System\UYaTAqe.exe
  C:\Windows\System\UYaTAqe.exe
  2⤵
  PID:8044
- C:\Windows\System\vfoXdTs.exe
  C:\Windows\System\vfoXdTs.exe
  2⤵
  PID:8108
- C:\Windows\System\KLiRpKW.exe
  C:\Windows\System\KLiRpKW.exe
  2⤵
  PID:8064
- C:\Windows\System\xumTIVd.exe
  C:\Windows\System\xumTIVd.exe
  2⤵
  PID:8176
- C:\Windows\System\rfsfBIj.exe
  C:\Windows\System\rfsfBIj.exe
  2⤵
  PID:8096
- C:\Windows\System\cZHQTvK.exe
  C:\Windows\System\cZHQTvK.exe
  2⤵
  PID:7276
- C:\Windows\System\PkgCXzH.exe
  C:\Windows\System\PkgCXzH.exe
  2⤵
  PID:7324
- C:\Windows\System\bREdGrI.exe
  C:\Windows\System\bREdGrI.exe
  2⤵
  PID:7180
- C:\Windows\System\EOLsyYU.exe
  C:\Windows\System\EOLsyYU.exe
  2⤵
  PID:7312
- C:\Windows\System\TgRzbmT.exe
  C:\Windows\System\TgRzbmT.exe
  2⤵
  PID:6720
- C:\Windows\System\mugNtZu.exe
  C:\Windows\System\mugNtZu.exe
  2⤵
  PID:7344
- C:\Windows\System\PlHWrfU.exe
  C:\Windows\System\PlHWrfU.exe
  2⤵
  PID:7500
- C:\Windows\System\KIxIFlM.exe
  C:\Windows\System\KIxIFlM.exe
  2⤵
  PID:7680
- C:\Windows\System\mASmKIQ.exe
  C:\Windows\System\mASmKIQ.exe
  2⤵
  PID:7664
- C:\Windows\System\MXmXDCi.exe
  C:\Windows\System\MXmXDCi.exe
  2⤵
  PID:7568
- C:\Windows\System\YVsejGw.exe
  C:\Windows\System\YVsejGw.exe
  2⤵
  PID:7748
- C:\Windows\System\jSPtfDf.exe
  C:\Windows\System\jSPtfDf.exe
  2⤵
  PID:7792
- C:\Windows\System\SOeCQuh.exe
  C:\Windows\System\SOeCQuh.exe
  2⤵
  PID:7796
- C:\Windows\System\TQinvqD.exe
  C:\Windows\System\TQinvqD.exe
  2⤵
  PID:7856
- C:\Windows\System\eOWwVhX.exe
  C:\Windows\System\eOWwVhX.exe
  2⤵
  PID:7976
- C:\Windows\System\COxfCzR.exe
  C:\Windows\System\COxfCzR.exe
  2⤵
  PID:8148
- C:\Windows\System\bbsZnPq.exe
  C:\Windows\System\bbsZnPq.exe
  2⤵
  PID:8032
- C:\Windows\System\mPMtrFr.exe
  C:\Windows\System\mPMtrFr.exe
  2⤵
  PID:7964
- C:\Windows\System\eEokUNO.exe
  C:\Windows\System\eEokUNO.exe
  2⤵
  PID:8092
- C:\Windows\System\QrFcdVd.exe
  C:\Windows\System\QrFcdVd.exe
  2⤵
  PID:7452
- C:\Windows\System\TsniqAd.exe
  C:\Windows\System\TsniqAd.exe
  2⤵
  PID:6756
- C:\Windows\System\vpFzsIm.exe
  C:\Windows\System\vpFzsIm.exe
  2⤵
  PID:7548
- C:\Windows\System\BvYXTvW.exe
  C:\Windows\System\BvYXTvW.exe
  2⤵
  PID:7844
- C:\Windows\System\SWTOkRp.exe
  C:\Windows\System\SWTOkRp.exe
  2⤵
  PID:7696
- C:\Windows\System\RIcBuMr.exe
  C:\Windows\System\RIcBuMr.exe
  2⤵
  PID:7956
- C:\Windows\System\bXnZidx.exe
  C:\Windows\System\bXnZidx.exe
  2⤵
  PID:8180
- C:\Windows\System\WxbLwAT.exe
  C:\Windows\System\WxbLwAT.exe
  2⤵
  PID:8016
- C:\Windows\System\mSQFDmj.exe
  C:\Windows\System\mSQFDmj.exe
  2⤵
  PID:7600
- C:\Windows\System\pPLXhrO.exe
  C:\Windows\System\pPLXhrO.exe
  2⤵
  PID:7904
- C:\Windows\System\IzePkbq.exe
  C:\Windows\System\IzePkbq.exe
  2⤵
  PID:7468
- C:\Windows\System\OcJLxII.exe
  C:\Windows\System\OcJLxII.exe
  2⤵
  PID:7944
- C:\Windows\System\JsYuGOo.exe
  C:\Windows\System\JsYuGOo.exe
  2⤵
  PID:8164
- C:\Windows\System\AHswLhL.exe
  C:\Windows\System\AHswLhL.exe
  2⤵
  PID:7732
- C:\Windows\System\kDgpWyw.exe
  C:\Windows\System\kDgpWyw.exe
  2⤵
  PID:8204
- C:\Windows\System\MVpWsIg.exe
  C:\Windows\System\MVpWsIg.exe
  2⤵
  PID:8220
- C:\Windows\System\WzYHIkx.exe
  C:\Windows\System\WzYHIkx.exe
  2⤵
  PID:8236
- C:\Windows\System\eYEjCdw.exe
  C:\Windows\System\eYEjCdw.exe
  2⤵
  PID:8252
- C:\Windows\System\xdwYxLD.exe
  C:\Windows\System\xdwYxLD.exe
  2⤵
  PID:8268
- C:\Windows\System\riCkiBG.exe
  C:\Windows\System\riCkiBG.exe
  2⤵
  PID:8284
- C:\Windows\System\yUhWjbb.exe
  C:\Windows\System\yUhWjbb.exe
  2⤵
  PID:8300
- C:\Windows\System\xNTsdbE.exe
  C:\Windows\System\xNTsdbE.exe
  2⤵
  PID:8316
- C:\Windows\System\KclIsql.exe
  C:\Windows\System\KclIsql.exe
  2⤵
  PID:8332
- C:\Windows\System\LLElvhT.exe
  C:\Windows\System\LLElvhT.exe
  2⤵
  PID:8348
- C:\Windows\System\LnrbLsV.exe
  C:\Windows\System\LnrbLsV.exe
  2⤵
  PID:8364
- C:\Windows\System\azCJWZO.exe
  C:\Windows\System\azCJWZO.exe
  2⤵
  PID:8380
- C:\Windows\System\ATXNKtV.exe
  C:\Windows\System\ATXNKtV.exe
  2⤵
  PID:8396
- C:\Windows\System\EQdGriX.exe
  C:\Windows\System\EQdGriX.exe
  2⤵
  PID:8412
- C:\Windows\System\FImXYmk.exe
  C:\Windows\System\FImXYmk.exe
  2⤵
  PID:8428
- C:\Windows\System\cKjUfpC.exe
  C:\Windows\System\cKjUfpC.exe
  2⤵
  PID:8444
- C:\Windows\System\LjGsxTQ.exe
  C:\Windows\System\LjGsxTQ.exe
  2⤵
  PID:8460
- C:\Windows\System\ZXlJgLL.exe
  C:\Windows\System\ZXlJgLL.exe
  2⤵
  PID:8476
- C:\Windows\System\gnGSGOn.exe
  C:\Windows\System\gnGSGOn.exe
  2⤵
  PID:8496
- C:\Windows\System\egkKwOy.exe
  C:\Windows\System\egkKwOy.exe
  2⤵
  PID:8512
- C:\Windows\System\OTooEaW.exe
  C:\Windows\System\OTooEaW.exe
  2⤵
  PID:8528
- C:\Windows\System\AngOfRb.exe
  C:\Windows\System\AngOfRb.exe
  2⤵
  PID:8544
- C:\Windows\System\QCPKGlS.exe
  C:\Windows\System\QCPKGlS.exe
  2⤵
  PID:8560
- C:\Windows\System\VmOvQNK.exe
  C:\Windows\System\VmOvQNK.exe
  2⤵
  PID:8576
- C:\Windows\System\ztLNUEi.exe
  C:\Windows\System\ztLNUEi.exe
  2⤵
  PID:8592
- C:\Windows\System\KBNWNxy.exe
  C:\Windows\System\KBNWNxy.exe
  2⤵
  PID:8608
- C:\Windows\System\LqmaDfk.exe
  C:\Windows\System\LqmaDfk.exe
  2⤵
  PID:8624
- C:\Windows\System\OMvxUUg.exe
  C:\Windows\System\OMvxUUg.exe
  2⤵
  PID:8640
- C:\Windows\System\WWBOchf.exe
  C:\Windows\System\WWBOchf.exe
  2⤵
  PID:8656
- C:\Windows\System\KyiFdYL.exe
  C:\Windows\System\KyiFdYL.exe
  2⤵
  PID:8672
- C:\Windows\System\dLpmxBZ.exe
  C:\Windows\System\dLpmxBZ.exe
  2⤵
  PID:8688
- C:\Windows\System\YsrRZWw.exe
  C:\Windows\System\YsrRZWw.exe
  2⤵
  PID:8704
- C:\Windows\System\ixaLwLP.exe
  C:\Windows\System\ixaLwLP.exe
  2⤵
  PID:8720
- C:\Windows\System\AZYbXEk.exe
  C:\Windows\System\AZYbXEk.exe
  2⤵
  PID:8736
- C:\Windows\System\MkDHmgg.exe
  C:\Windows\System\MkDHmgg.exe
  2⤵
  PID:8752
- C:\Windows\System\cUHUbsw.exe
  C:\Windows\System\cUHUbsw.exe
  2⤵
  PID:8768
- C:\Windows\System\aiaZPif.exe
  C:\Windows\System\aiaZPif.exe
  2⤵
  PID:8784
- C:\Windows\System\FyxqslS.exe
  C:\Windows\System\FyxqslS.exe
  2⤵
  PID:8800
- C:\Windows\System\kDILIgA.exe
  C:\Windows\System\kDILIgA.exe
  2⤵
  PID:8816
- C:\Windows\System\IVJFaxV.exe
  C:\Windows\System\IVJFaxV.exe
  2⤵
  PID:8832
- C:\Windows\System\yAjtGha.exe
  C:\Windows\System\yAjtGha.exe
  2⤵
  PID:8848
- C:\Windows\System\XrlpCHS.exe
  C:\Windows\System\XrlpCHS.exe
  2⤵
  PID:8864
- C:\Windows\System\obmSaIE.exe
  C:\Windows\System\obmSaIE.exe
  2⤵
  PID:8880
- C:\Windows\System\wiWYYnN.exe
  C:\Windows\System\wiWYYnN.exe
  2⤵
  PID:8896
- C:\Windows\System\FceaTmf.exe
  C:\Windows\System\FceaTmf.exe
  2⤵
  PID:8912
- C:\Windows\System\rUhBJLP.exe
  C:\Windows\System\rUhBJLP.exe
  2⤵
  PID:8928
- C:\Windows\System\OsaaFnl.exe
  C:\Windows\System\OsaaFnl.exe
  2⤵
  PID:8944
- C:\Windows\System\qbCVvdA.exe
  C:\Windows\System\qbCVvdA.exe
  2⤵
  PID:8960
- C:\Windows\System\XHtzoRB.exe
  C:\Windows\System\XHtzoRB.exe
  2⤵
  PID:8976
- C:\Windows\System\DDOzcpn.exe
  C:\Windows\System\DDOzcpn.exe
  2⤵
  PID:8996
- C:\Windows\System\sFQwYhe.exe
  C:\Windows\System\sFQwYhe.exe
  2⤵
  PID:9012
- C:\Windows\System\SWAoumk.exe
  C:\Windows\System\SWAoumk.exe
  2⤵
  PID:9028
- C:\Windows\System\GbdSnUg.exe
  C:\Windows\System\GbdSnUg.exe
  2⤵
  PID:9044
- C:\Windows\System\NKGfYAD.exe
  C:\Windows\System\NKGfYAD.exe
  2⤵
  PID:9060
- C:\Windows\System\NzJtWKD.exe
  C:\Windows\System\NzJtWKD.exe
  2⤵
  PID:9076
- C:\Windows\System\ajzaPqn.exe
  C:\Windows\System\ajzaPqn.exe
  2⤵
  PID:9092
- C:\Windows\System\LgprNIV.exe
  C:\Windows\System\LgprNIV.exe
  2⤵
  PID:9108
- C:\Windows\System\dXsoTbE.exe
  C:\Windows\System\dXsoTbE.exe
  2⤵
  PID:9124
- C:\Windows\System\iuFRQSA.exe
  C:\Windows\System\iuFRQSA.exe
  2⤵
  PID:9140
- C:\Windows\System\PFFdpKX.exe
  C:\Windows\System\PFFdpKX.exe
  2⤵
  PID:9156
- C:\Windows\System\WWMCLzv.exe
  C:\Windows\System\WWMCLzv.exe
  2⤵
  PID:9172
- C:\Windows\System\CtBROqg.exe
  C:\Windows\System\CtBROqg.exe
  2⤵
  PID:9188
- C:\Windows\System\VHvzcwN.exe
  C:\Windows\System\VHvzcwN.exe
  2⤵
  PID:9204
- C:\Windows\System\oUxmuHO.exe
  C:\Windows\System\oUxmuHO.exe
  2⤵
  PID:7356
- C:\Windows\System\pEAMVHv.exe
  C:\Windows\System\pEAMVHv.exe
  2⤵
  PID:8196
- C:\Windows\System\LyMDBeU.exe
  C:\Windows\System\LyMDBeU.exe
  2⤵
  PID:8248
- C:\Windows\System\EeLpzVp.exe
  C:\Windows\System\EeLpzVp.exe
  2⤵
  PID:8276
- C:\Windows\System\kLHqYMv.exe
  C:\Windows\System\kLHqYMv.exe
  2⤵
  PID:8312
- C:\Windows\System\FDgoVre.exe
  C:\Windows\System\FDgoVre.exe
  2⤵
  PID:8340
- C:\Windows\System\jmOqGvz.exe
  C:\Windows\System\jmOqGvz.exe
  2⤵
  PID:8376
- C:\Windows\System\stfZKMs.exe
  C:\Windows\System\stfZKMs.exe
  2⤵
  PID:8404
- C:\Windows\System\HbIVlxN.exe
  C:\Windows\System\HbIVlxN.exe
  2⤵
  PID:8424
- C:\Windows\System\IzSqcLC.exe
  C:\Windows\System\IzSqcLC.exe
  2⤵
  PID:8472
- C:\Windows\System\aDGFTir.exe
  C:\Windows\System\aDGFTir.exe
  2⤵
  PID:7928
- C:\Windows\System\EHsBsNk.exe
  C:\Windows\System\EHsBsNk.exe
  2⤵
  PID:8568
- C:\Windows\System\Yoxjykn.exe
  C:\Windows\System\Yoxjykn.exe
  2⤵
  PID:8572
- C:\Windows\System\NAOHpCh.exe
  C:\Windows\System\NAOHpCh.exe
  2⤵
  PID:8584
- C:\Windows\System\AfkvPag.exe
  C:\Windows\System\AfkvPag.exe
  2⤵
  PID:8744
- C:\Windows\System\DipgaKL.exe
  C:\Windows\System\DipgaKL.exe
  2⤵
  PID:8652
- C:\Windows\System\HdyRIqp.exe
  C:\Windows\System\HdyRIqp.exe
  2⤵
  PID:8796
- C:\Windows\System\ZauHsDZ.exe
  C:\Windows\System\ZauHsDZ.exe
  2⤵
  PID:8888
- C:\Windows\System\RvnaIxR.exe
  C:\Windows\System\RvnaIxR.exe
  2⤵
  PID:8780
- C:\Windows\System\zRflvrU.exe
  C:\Windows\System\zRflvrU.exe
  2⤵
  PID:8812
- C:\Windows\System\SVDxCQc.exe
  C:\Windows\System\SVDxCQc.exe
  2⤵
  PID:8956
- C:\Windows\System\ifpwNBm.exe
  C:\Windows\System\ifpwNBm.exe
  2⤵
  PID:8992
- C:\Windows\System\hWIEbPW.exe
  C:\Windows\System\hWIEbPW.exe
  2⤵
  PID:8908
- C:\Windows\System\OMccEUB.exe
  C:\Windows\System\OMccEUB.exe
  2⤵
  PID:8972
- C:\Windows\System\khISdRC.exe
  C:\Windows\System\khISdRC.exe
  2⤵
  PID:9040
- C:\Windows\System\DbqMRtj.exe
  C:\Windows\System\DbqMRtj.exe
  2⤵
  PID:9068
- C:\Windows\System\nyLjlKx.exe
  C:\Windows\System\nyLjlKx.exe
  2⤵
  PID:9120
- C:\Windows\System\PEMriKb.exe
  C:\Windows\System\PEMriKb.exe
  2⤵
  PID:9180
- C:\Windows\System\cLuaESr.exe
  C:\Windows\System\cLuaESr.exe
  2⤵
  PID:9104
- C:\Windows\System\PurYReB.exe
  C:\Windows\System\PurYReB.exe
  2⤵
  PID:8216
- C:\Windows\System\VtGnbIo.exe
  C:\Windows\System\VtGnbIo.exe
  2⤵
  PID:8328
- C:\Windows\System\vKqVtvN.exe
  C:\Windows\System\vKqVtvN.exe
  2⤵
  PID:8456
- C:\Windows\System\dDuDmoe.exe
  C:\Windows\System\dDuDmoe.exe
  2⤵
  PID:8604
- C:\Windows\System\ZwkEios.exe
  C:\Windows\System\ZwkEios.exe
  2⤵
  PID:8360
- C:\Windows\System\FxeiErY.exe
  C:\Windows\System\FxeiErY.exe
  2⤵
  PID:9200
- C:\Windows\System\VMtIgTs.exe
  C:\Windows\System\VMtIgTs.exe
  2⤵
  PID:8260
- C:\Windows\System\cyUZjXS.exe
  C:\Windows\System\cyUZjXS.exe
  2⤵
  PID:8636
- C:\Windows\System\bWqCMuV.exe
  C:\Windows\System\bWqCMuV.exe
  2⤵
  PID:8700
- C:\Windows\System\dlLFObu.exe
  C:\Windows\System\dlLFObu.exe
  2⤵
  PID:8760
- C:\Windows\System\Gpqigjb.exe
  C:\Windows\System\Gpqigjb.exe
  2⤵
  PID:8748
- C:\Windows\System\EERpBki.exe
  C:\Windows\System\EERpBki.exe
  2⤵
  PID:8620
- C:\Windows\System\zElbOsp.exe
  C:\Windows\System\zElbOsp.exe
  2⤵
  PID:8828
- C:\Windows\System\WWICgAt.exe
  C:\Windows\System\WWICgAt.exe
  2⤵
  PID:9052
- C:\Windows\System\xOoUcAh.exe
  C:\Windows\System\xOoUcAh.exe
  2⤵
  PID:9008
- C:\Windows\System\RtlKtVT.exe
  C:\Windows\System\RtlKtVT.exe
  2⤵
  PID:8488
- C:\Windows\System\wJorRdo.exe
  C:\Windows\System\wJorRdo.exe
  2⤵
  PID:8616
- C:\Windows\System\DcEFWgd.exe
  C:\Windows\System\DcEFWgd.exe
  2⤵
  PID:8840
- C:\Windows\System\xBLFqEr.exe
  C:\Windows\System\xBLFqEr.exe
  2⤵
  PID:8872
- C:\Windows\System\jceDiJW.exe
  C:\Windows\System\jceDiJW.exe
  2⤵
  PID:8876
- C:\Windows\System\bZDfaFV.exe
  C:\Windows\System\bZDfaFV.exe
  2⤵
  PID:9196
- C:\Windows\System\InbHIJQ.exe
  C:\Windows\System\InbHIJQ.exe
  2⤵
  PID:9148
- C:\Windows\System\lUktNzv.exe
  C:\Windows\System\lUktNzv.exe
  2⤵
  PID:8308
- C:\Windows\System\TSSAfch.exe
  C:\Windows\System\TSSAfch.exe
  2⤵
  PID:8408
- C:\Windows\System\OFHyqCh.exe
  C:\Windows\System\OFHyqCh.exe
  2⤵
  PID:8420
- C:\Windows\System\DgEhvOt.exe
  C:\Windows\System\DgEhvOt.exe
  2⤵
  PID:8296
- C:\Windows\System\TXSitIn.exe
  C:\Windows\System\TXSitIn.exe
  2⤵
  PID:8732
- C:\Windows\System\MzoATIP.exe
  C:\Windows\System\MzoATIP.exe
  2⤵
  PID:8904
- C:\Windows\System\vvAmOzf.exe
  C:\Windows\System\vvAmOzf.exe
  2⤵
  PID:8712
- C:\Windows\System\imOmMsp.exe
  C:\Windows\System\imOmMsp.exe
  2⤵
  PID:8540
- C:\Windows\System\abUjogN.exe
  C:\Windows\System\abUjogN.exe
  2⤵
  PID:8968
- C:\Windows\System\hlcSxOz.exe
  C:\Windows\System\hlcSxOz.exe
  2⤵
  PID:7044
- C:\Windows\System\ymRvQNM.exe
  C:\Windows\System\ymRvQNM.exe
  2⤵
  PID:8524
- C:\Windows\System\xBlLlkB.exe
  C:\Windows\System\xBlLlkB.exe
  2⤵
  PID:9152
- C:\Windows\System\rYSwrWM.exe
  C:\Windows\System\rYSwrWM.exe
  2⤵
  PID:8920
- C:\Windows\System\SxNVZRq.exe
  C:\Windows\System\SxNVZRq.exe
  2⤵
  PID:9020
- C:\Windows\System\dDULhIj.exe
  C:\Windows\System\dDULhIj.exe
  2⤵
  PID:9232
- C:\Windows\System\DTBVFvB.exe
  C:\Windows\System\DTBVFvB.exe
  2⤵
  PID:9248
- C:\Windows\System\wWowxSt.exe
  C:\Windows\System\wWowxSt.exe
  2⤵
  PID:9264
- C:\Windows\System\yoHJonJ.exe
  C:\Windows\System\yoHJonJ.exe
  2⤵
  PID:9280
- C:\Windows\System\CFZSTWW.exe
  C:\Windows\System\CFZSTWW.exe
  2⤵
  PID:9300
- C:\Windows\System\xNmLmGa.exe
  C:\Windows\System\xNmLmGa.exe
  2⤵
  PID:9316
- C:\Windows\System\lMGAaKE.exe
  C:\Windows\System\lMGAaKE.exe
  2⤵
  PID:9332
- C:\Windows\System\RKgIAKD.exe
  C:\Windows\System\RKgIAKD.exe
  2⤵
  PID:9396
- C:\Windows\System\YEAIQRa.exe
  C:\Windows\System\YEAIQRa.exe
  2⤵
  PID:9420
- C:\Windows\System\TsqarVM.exe
  C:\Windows\System\TsqarVM.exe
  2⤵
  PID:9436
- C:\Windows\System\KAiggoz.exe
  C:\Windows\System\KAiggoz.exe
  2⤵
  PID:9452
- C:\Windows\System\gYJlIom.exe
  C:\Windows\System\gYJlIom.exe
  2⤵
  PID:9468
- C:\Windows\System\qVPujTu.exe
  C:\Windows\System\qVPujTu.exe
  2⤵
  PID:9488
- C:\Windows\System\oYLclGk.exe
  C:\Windows\System\oYLclGk.exe
  2⤵
  PID:9504
- C:\Windows\System\kiAFZTM.exe
  C:\Windows\System\kiAFZTM.exe
  2⤵
  PID:9520
- C:\Windows\System\IBfzxSx.exe
  C:\Windows\System\IBfzxSx.exe
  2⤵
  PID:10100
- C:\Windows\System\LkOBJrk.exe
  C:\Windows\System\LkOBJrk.exe
  2⤵
  PID:10192
- C:\Windows\System\FDeljNu.exe
  C:\Windows\System\FDeljNu.exe
  2⤵
  PID:9224
- C:\Windows\System\DkvAATd.exe
  C:\Windows\System\DkvAATd.exe
  2⤵
  PID:9596
- C:\Windows\System\RprnWOY.exe
  C:\Windows\System\RprnWOY.exe
  2⤵
  PID:9688
- C:\Windows\System\urcdOaS.exe
  C:\Windows\System\urcdOaS.exe
  2⤵
  PID:9500
- C:\Windows\System\VbloQhU.exe
  C:\Windows\System\VbloQhU.exe
  2⤵
  PID:9584
- C:\Windows\System\MpOacEq.exe
  C:\Windows\System\MpOacEq.exe
  2⤵
  PID:9612
- C:\Windows\System\lVoQpXG.exe
  C:\Windows\System\lVoQpXG.exe
  2⤵
  PID:9640
- C:\Windows\System\bEoOCXa.exe
  C:\Windows\System\bEoOCXa.exe
  2⤵
  PID:9660
- C:\Windows\System\EDCOUvX.exe
  C:\Windows\System\EDCOUvX.exe
  2⤵
  PID:9696
- C:\Windows\System\ILcFHgG.exe
  C:\Windows\System\ILcFHgG.exe
  2⤵
  PID:9724
- C:\Windows\System\OQBTtsD.exe
  C:\Windows\System\OQBTtsD.exe
  2⤵
  PID:9740
- C:\Windows\System\RumwytC.exe
  C:\Windows\System\RumwytC.exe
  2⤵
  PID:9756
- C:\Windows\System\oOSxCQD.exe
  C:\Windows\System\oOSxCQD.exe
  2⤵
  PID:9916
- C:\Windows\System\rDnrGxn.exe
  C:\Windows\System\rDnrGxn.exe
  2⤵
  PID:9976
- C:\Windows\System\zvOHPBo.exe
  C:\Windows\System\zvOHPBo.exe
  2⤵
  PID:10012
- C:\Windows\System\WCSBpCo.exe
  C:\Windows\System\WCSBpCo.exe
  2⤵
  PID:10028
- C:\Windows\System\waCILyF.exe
  C:\Windows\System\waCILyF.exe
  2⤵
  PID:10056
- C:\Windows\System\foxuCFc.exe
  C:\Windows\System\foxuCFc.exe
  2⤵
  PID:10108
- C:\Windows\System\rSuVFrb.exe
  C:\Windows\System\rSuVFrb.exe
  2⤵
  PID:10136
- C:\Windows\System\ImJpogr.exe
  C:\Windows\System\ImJpogr.exe
  2⤵
  PID:10152
- C:\Windows\System\NKxfaqQ.exe
  C:\Windows\System\NKxfaqQ.exe
  2⤵
  PID:10168
- C:\Windows\System\SyhhFfj.exe
  C:\Windows\System\SyhhFfj.exe
  2⤵
  PID:10184
- C:\Windows\System\NvEmcaX.exe
  C:\Windows\System\NvEmcaX.exe
  2⤵
  PID:10116
- C:\Windows\System\fWjUSQt.exe
  C:\Windows\System\fWjUSQt.exe
  2⤵
  PID:10076
- C:\Windows\System\fWZIkDs.exe
  C:\Windows\System\fWZIkDs.exe
  2⤵
  PID:10092
- C:\Windows\System\nFjwCni.exe
  C:\Windows\System\nFjwCni.exe
  2⤵
  PID:10220
- C:\Windows\System\RyRoPHr.exe
  C:\Windows\System\RyRoPHr.exe
  2⤵
  PID:9308
- C:\Windows\System\UzIFHWU.exe
  C:\Windows\System\UzIFHWU.exe
  2⤵
  PID:10212
- C:\Windows\System\XPfKdPN.exe
  C:\Windows\System\XPfKdPN.exe
  2⤵
  PID:8600
- C:\Windows\System\bhtXIJT.exe
  C:\Windows\System\bhtXIJT.exe
  2⤵
  PID:9364
- C:\Windows\System\gakGooQ.exe
  C:\Windows\System\gakGooQ.exe
  2⤵
  PID:9228
- C:\Windows\System\OSFUJan.exe
  C:\Windows\System\OSFUJan.exe
  2⤵
  PID:9372
- C:\Windows\System\cXFAavW.exe
  C:\Windows\System\cXFAavW.exe
  2⤵
  PID:9408
- C:\Windows\System\gfLLVFM.exe
  C:\Windows\System\gfLLVFM.exe
  2⤵
  PID:9328
- C:\Windows\System\sCjxRng.exe
  C:\Windows\System\sCjxRng.exe
  2⤵
  PID:9484
- C:\Windows\System\zsTpsnr.exe
  C:\Windows\System\zsTpsnr.exe
  2⤵
  PID:9552
- C:\Windows\System\hVeETAG.exe
  C:\Windows\System\hVeETAG.exe
  2⤵
  PID:9568
- C:\Windows\System\xNMchyN.exe
  C:\Windows\System\xNMchyN.exe
  2⤵
  PID:9788
- C:\Windows\System\rnrQOXD.exe
  C:\Windows\System\rnrQOXD.exe
  2⤵
  PID:9808
- C:\Windows\System\edDMNvz.exe
  C:\Windows\System\edDMNvz.exe
  2⤵
  PID:9832
- C:\Windows\System\kqfVNjJ.exe
  C:\Windows\System\kqfVNjJ.exe
  2⤵
  PID:9864
- C:\Windows\System\gkBebiC.exe
  C:\Windows\System\gkBebiC.exe
  2⤵
  PID:9884
- C:\Windows\System\GAHCLjs.exe
  C:\Windows\System\GAHCLjs.exe
  2⤵
  PID:9904
- C:\Windows\System\KjDCIuq.exe
  C:\Windows\System\KjDCIuq.exe
  2⤵
  PID:9924
- C:\Windows\System\TPNgVSh.exe
  C:\Windows\System\TPNgVSh.exe
  2⤵
  PID:9944
- C:\Windows\System\iRCATMd.exe
  C:\Windows\System\iRCATMd.exe
  2⤵
  PID:10000
- C:\Windows\System\sPSZDAW.exe
  C:\Windows\System\sPSZDAW.exe
  2⤵
  PID:9952
- C:\Windows\System\sUYRLSS.exe
  C:\Windows\System\sUYRLSS.exe
  2⤵
  PID:9972
- C:\Windows\System\UQsxwrV.exe
  C:\Windows\System\UQsxwrV.exe
  2⤵
  PID:10044
- C:\Windows\System\wqzZSsZ.exe
  C:\Windows\System\wqzZSsZ.exe
  2⤵
  PID:9348
- C:\Windows\System\ioCnUTc.exe
  C:\Windows\System\ioCnUTc.exe
  2⤵
  PID:9296
- C:\Windows\System\BwxWFri.exe
  C:\Windows\System\BwxWFri.exe
  2⤵
  PID:9616
- C:\Windows\System\KirHABg.exe
  C:\Windows\System\KirHABg.exe
  2⤵
  PID:9516
- C:\Windows\System\tmoWLQZ.exe
  C:\Windows\System\tmoWLQZ.exe
  2⤵
  PID:10144
- C:\Windows\System\oxxIuVE.exe
  C:\Windows\System\oxxIuVE.exe
  2⤵
  PID:10064
- C:\Windows\System\MbqxBvz.exe
  C:\Windows\System\MbqxBvz.exe
  2⤵
  PID:10208
- C:\Windows\System\caYRNLp.exe
  C:\Windows\System\caYRNLp.exe
  2⤵
  PID:9676
- C:\Windows\System\lVnwTaK.exe
  C:\Windows\System\lVnwTaK.exe
  2⤵
  PID:9428
- C:\Windows\System\kLJfntP.exe
  C:\Windows\System\kLJfntP.exe
  2⤵
  PID:9432
- C:\Windows\System\dHXvVZa.exe
  C:\Windows\System\dHXvVZa.exe
  2⤵
  PID:9464
- C:\Windows\System\oomQMzR.exe
  C:\Windows\System\oomQMzR.exe
  2⤵
  PID:9632
- C:\Windows\System\wVsRpxw.exe
  C:\Windows\System\wVsRpxw.exe
  2⤵
  PID:9736
- C:\Windows\System\yRGPgwt.exe
  C:\Windows\System\yRGPgwt.exe
  2⤵
  PID:9712
- C:\Windows\System\UcejjYd.exe
  C:\Windows\System\UcejjYd.exe
  2⤵
  PID:9608
- C:\Windows\System\PHEpFNw.exe
  C:\Windows\System\PHEpFNw.exe
  2⤵
  PID:9792
- C:\Windows\System\UsAWIZP.exe
  C:\Windows\System\UsAWIZP.exe
  2⤵
  PID:9772
- C:\Windows\System\gsrtDlW.exe
  C:\Windows\System\gsrtDlW.exe
  2⤵
  PID:9800
- C:\Windows\System\QEZkdja.exe
  C:\Windows\System\QEZkdja.exe
  2⤵
  PID:9856
- C:\Windows\System\gyJpOjM.exe
  C:\Windows\System\gyJpOjM.exe
  2⤵
  PID:9848
- C:\Windows\System\hxsvxNh.exe
  C:\Windows\System\hxsvxNh.exe
  2⤵
  PID:9896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DUJOQFh.exe

Filesize
1.9MB

MD5
4ab481632b0586eb9fe84d0ae348de5b

SHA1
9f5b2fc7ca366707776b42b56a985a043d8c1ee4

SHA256
1e21cbd565ca20445c72ea01c62405840b385de98e2694a9e4f6a031518b3c4d

SHA512
d216eb5194f8cb99e1ccf65a2ca412c889a7eb0b0f35172979ea04f37a9fe519e4234b9072bc5ecb7cb2bb24c5e7e2f3e303e2758e9ae81a27d5a565ef9c6930

Download Submit
C:\Windows\system\GVWLTny.exe

Filesize
1.9MB

MD5
cc3f6a9bb610b146fd45ceeef52276d1

SHA1
308596a907fe479f02442f857f0220fdc003f895

SHA256
3b7a963217e29b0b392ae5c6a712f0fff764ab20c63e81dde9d7eb9ec20d5a68

SHA512
db2b499b69301303337e4564f52b423708c997719a61ff1fb383891a500a6465931b2f149ed98d4961f11aacc02a7efd4dde4e5dd9a29d57492c8f2c610ea03a

Download Submit
C:\Windows\system\HkfdpcU.exe

Filesize
1.9MB

MD5
ec64467572ee343946a8466dc801c6a2

SHA1
6ebb2dd00113a93383cdd8597a690a971b657c7e

SHA256
084458c18823bbae5104cbf17d1daf947aba9bc6c181bb30d6cdf3b3bc6c9cf0

SHA512
9ca1e3fadf68bc44dbaf7a25fa34afc910ce3b122cfe68fab08de123966015c3d6f6f54dc11a5bb56d0379ca18e3ce7119bde48d1bb22ef3446637d75c2ee237

Download Submit
C:\Windows\system\KhGCWSV.exe

Filesize
1.9MB

MD5
0fb6e5742e72751062a64f83e2ecad1b

SHA1
8c75aab83af2a8c8a54f22b111981a9a7ebd0fbe

SHA256
372e39ce911f8c3453894a021bee9e5005ac3fcc741d03ffd4a92a1766e25e41

SHA512
a19e8e7a8a11d3b7a92ab8e821a01e728fca80d694b08bea217500f13ce867e47a35343b15de4fe83651c9db42bdf8fdfafcfb071bd56c002c55dfaa5ec728c2

Download Submit
C:\Windows\system\MiydccD.exe

Filesize
1.9MB

MD5
92487ba810fc9081f323fa780c7e8ec3

SHA1
625758a9c55bf2f085d021a4fdfdf6951918e93d

SHA256
e4e724e955d5b5ee948b39a9c0d7f436a34ac603ee3daf9b6bbdd95ba35731d8

SHA512
f8f0f964313ff212148627efc0ddcc2fbf6666fd3271cae81a9355ed55a9c724190b7ba80d40bec53147bbc51d4c7f1be782a0ebdd8f88e924740dc5b3d809aa

Download Submit
C:\Windows\system\QiUKqLH.exe

Filesize
1.9MB

MD5
e9cd2ba9d912e46ed51eb9ba9c1f8a35

SHA1
67cea25ef37af29ab5c9b834e3e56ca3109633ce

SHA256
e1c1de1b8aa6e53fa33368559bd2c2e026daacf162016790315c64c23b2d08df

SHA512
2cb323ff9dd847d616fbbd016a0bd39360ce1916283f11f8059dab684113096139f140352e858d306b7be38be0b01c3a76826a941b819b188570345ba2d262a6

Download Submit
C:\Windows\system\RNMOMOo.exe

Filesize
1.9MB

MD5
766e5eecdd90c088cd78276c54f8d457

SHA1
6e9243efc06e3bd98979ae50fd1d0f5c626f09d7

SHA256
11e458265b9d91e809053cf4c71678e9ede37701a5e54d82907ca85e1cc72a84

SHA512
7da5cdb71677d6d3b90ef2665f7922f22ee7760be801b35723a2657ea64e3368e871be59ff76b513b167c3b0cee2db62d049810e6f5c2c65f13aa42be4906ef3

Download Submit
C:\Windows\system\RWSSxKZ.exe

Filesize
1.9MB

MD5
2d35b4a2f779c1005422b16b901fc04c

SHA1
2a5689f1806952a7adfb2eba0b98fc38209d1486

SHA256
c69aa9b57d215ce9bce34efd0f21fb5c52ba9b158a35a34339353a8b28b73ff1

SHA512
f01551b7986ef60280ad8e62e03e9998542ebf97f435db92bce69365b61ec2d8a943a4b4140298adc765ad0529d0f3048534dfa8ec5d3d02f45702338d720861

Download Submit
C:\Windows\system\STDuGQy.exe

Filesize
1.9MB

MD5
d19f5f2d2cfdd8b1e8715f803ae88ebf

SHA1
67b3a04c47ef680a84754ac56076995bad74512c

SHA256
e5d8746b8449b5049491d6c2e757f710c8af24d5b1bb6d360c4f9751af757cef

SHA512
739eff68c30fd268df5ec9c1cfb6a7ad40947ae9ff33670c9372056730d50cb609cb4ea24105f858f5a8328c3fbbc52148a2dca9720a9b39ad65597187a6012d

Download Submit
C:\Windows\system\VwmXeIY.exe

Filesize
1.9MB

MD5
8ece2ce8215db7a2d54f38d05f62dd48

SHA1
e67056ab31231c6273df7b6bcddd5f6d1daac4f3

SHA256
175555191aeec3b020f522d3f69295f6b6c128c03159243f07df16b0a345c6c9

SHA512
bb4b5a62ea142086fc90454c971b8e9eed75d8bf7e09bf389e66547a08c497c6579a9f98ec2ba498e881ecdcac65d3a3b34f33e9dd7358bcdc54f084d84fff3d

Download Submit
C:\Windows\system\XIONrTk.exe

Filesize
1.9MB

MD5
35b27e3103f027ad1847050184779d3b

SHA1
449b68377f9168542f35a1315e23cfac00ff29e2

SHA256
f823df46fc0f7f760c0d1d8ebd988e6b27fcc2bf805ff6716d928b14cdc89238

SHA512
2800851ea418749eda3a213580c351efdd977b7604fa780cf59f18d13d57743d0467ffc43377caaa77189d4cde0c6ca28235a3bc607889f787a096dceb1c4727

Download Submit
C:\Windows\system\cHAtPVF.exe

Filesize
1.9MB

MD5
8e9a168be0f4bc59d8762e29537d7a46

SHA1
4e5a0d43714b53ef7ef67de89e0eae242147d87b

SHA256
891d490feb6cfca64124d2c1f1c7e22d39e7ea3782708403b919d9a0f902859b

SHA512
bdedfff39be2c5da67dab937c4ea67e82a1272c7bb5afd1c6be515917a881e667719e12f7c9aa81573dae3c3218aec7b2423eef865bd7c7732e60c46b350b29e

Download Submit
C:\Windows\system\gKhxKoo.exe

Filesize
1.9MB

MD5
0946802a36975159e74152179965bce1

SHA1
8d56156f0a7aadbd58353fef17e06f99b1c25087

SHA256
bb22f551c32e577479e766cd3fdd46774650863b0d9a93d892d908ba1ae143e4

SHA512
92c7c511752d6693e2f9bd39b43346e86cf85dce4676ffb03190a89dea9033496f459c94249c20e8112054db610a3f03f9dedc13f2a1789b2d5b8a370a8c4a93

Download Submit
C:\Windows\system\gylfmts.exe

Filesize
1.9MB

MD5
e5d7ce3baf8ac6c721f70aeb0f17e29f

SHA1
bad2cb6666b53fa04bd157908023f342797a5872

SHA256
f277cd12bf4e7d896ebcddc9f15f5e447e8f8385be4eeb0f6cfcb0ca6fa15c1b

SHA512
07d192e999e4027a4f4196bed97112f234d096e892ebb35e658287b7b7c64dc8ed4b65de39065f72d985215e0cdf9abe6c19a586faba17babed0c2f0f5215e7c

Download Submit
C:\Windows\system\ikogXKH.exe

Filesize
1.9MB

MD5
783921d56369e32235152fc0109caf41

SHA1
d11aa7e8ecc6671a4cb483129c246435b12a09e3

SHA256
f7783ead32329b59e6892ad3e65ba72ee242fe8b39a18c485f5332d8cd1f99ca

SHA512
606235e755fce6760191292a7415ebec2dd0d7e54c154b33d419b862a2d009f55e7a40a2d82db44df0719dfd54306b359c60653af0511d5e5c336368b2ed2e5c

Download Submit
C:\Windows\system\ilMOnXT.exe

Filesize
1.9MB

MD5
2ca4955a553b78e454ee9eb8c8b4ac9b

SHA1
6b5b1568c603c026eadb8a418212a5c83585c569

SHA256
b71798affed8dce8969302d6c738c929c63eea642bd59c2728c7643d8590793f

SHA512
bffa88d7b0f96d9652d1b8cfa96bdb9b9676877f5e18df26acd54b135c698d420788af2d39f8bd3b2803688b706daf912f6563b18f53a2a58813592bf1adbb9c

Download Submit
C:\Windows\system\kjoJcWt.exe

Filesize
1.9MB

MD5
194cb060262fd6dbcf55900513843933

SHA1
bb11b0de4c91d04c0a3695930af3e626f52d355a

SHA256
a4013b69c216f090d64a0b58681161fe45cd46ecdc27f846fa294fc930c28f30

SHA512
44b66ecbaa43958c577f660c3750b78b9133d91760978662d58b8819ec7b2074b60231c051e4cbc06ade62e5544bafff948df03458a311bcf6e59ccbc150ab46

Download Submit
C:\Windows\system\ngfTSit.exe

Filesize
1.9MB

MD5
5f5fe0efe8f13c089402e27fc188ac1a

SHA1
fdcab947d95b052b4881dc2ca2a84fdd726bc12a

SHA256
72f1365b4d4a1e6d5e9900873348753d2133f410ad46a069c1ce9bcbcb129334

SHA512
5d72a6fbadfe62755fa6ec02106b4d168b9fe0b8cdee50b96e388b177d4f34391657f96225182ba4a7e09e19432a8541c78844281b1f05f09f7b9f615838c5eb

Download Submit
C:\Windows\system\pCZCOnd.exe

Filesize
1.9MB

MD5
fdf64c38af4dcb17785aacdfc0fbc3e4

SHA1
500d0e79d5e5d2e96ad00be4e25c473a02aa52fe

SHA256
08467a49674b5b42f0c6e7ef91369a9fa910f8781fa1005ee7f4806b878f7a09

SHA512
be0ac10e8c51164716371eee010b47bdd04ede2a6554fc43fd43c403f376aa9397a73cab08e7eab7f8a7de3165e6d4263bb72a8f0a1d2e9c78db22df5821c4d4

Download Submit
C:\Windows\system\rkYIYaB.exe

Filesize
1.9MB

MD5
cf56558d88e1143da5c3a26d1a424e20

SHA1
72745bbcf7eaaa6275c53d0a1c5a2498246e89dc

SHA256
e991646807fdfa9412defbfbbcd3d5a8edcfd1763c01d6a7c32fb33dedda8fa3

SHA512
bebd758bac31ab1f02b3505a07117db1bf21d034c51b0ca4c7d27048fcea3d1f5d8bf8f34af146be03a9e95fdcee3491afc786162f5d782c7db519a30632fbe8

Download Submit
C:\Windows\system\tHlItRA.exe

Filesize
1.9MB

MD5
18975a4608422b01f2280930db9eb1b7

SHA1
578572f5010bab6c587f7bfc60a5d77c90e3d43a

SHA256
9c620966348f615bef24383344b851821283ed65926e1fabc30cf1e029384a7b

SHA512
1f16a20495c69127f2fc371f9fa76ee0fca07a2ea599c4883cd72350f3eb765d2e3737495258bc7fdad518572b2ee502053d23cb394677990349fff6405870ce

Download Submit
C:\Windows\system\tOqJvSZ.exe

Filesize
1.9MB

MD5
3000f24dfb6549d394d4b0564abab508

SHA1
46221ae73d20850c773e49b951feba64f933e9bf

SHA256
80e10007e904a37e3327602acb731608fb75926d556099fb2965e83c60f3eaf2

SHA512
b8b6e02c103c546c3cde09f6d3345f17b1a5393edefa7957dc7fde46b7efe1a07dfe5c1b9df0fbd41e171db0df79fe08ad0aebfb374111e5e22e9b546b57a886

Download Submit
C:\Windows\system\uAxakeE.exe

Filesize
1.9MB

MD5
a031ae26ad839d3d53db052282245208

SHA1
98f9fb5ee8a97fcfef025da763dab738f4a5726f

SHA256
49ba26b39fc0577d6a95bc4d097091845e09ef8d30e39c339701b806e084602d

SHA512
0f1fc0413151a531346b47cbc1e9882c3250f54a697827259ad03f0eaa0314a43936eaceacb0541c36ee11ba303c83d921af7089706b43c411643a488485c416

Download Submit
C:\Windows\system\zTMdkeg.exe

Filesize
1.9MB

MD5
3a146f3f67a9cf92527b8622d58be9f9

SHA1
173d5b02999edb76cd586c87e4fb33e402958d68

SHA256
cb9f31387c82d57c41106ef2e999ea3fb2b4cec5c23b15857c385b411ba6d313

SHA512
eb6531ffb380317241e9a63e833a9fb10c07a186375a42c5cddf2d017163067bf57ee9246b21a3c104cd9258f3d627b9a08eac595131e0e36a1891c8b2bf6886

Download Submit
\Windows\system\Bxwfqes.exe

Filesize
1.9MB

MD5
a43bc33be0546f92f6b7025a7067577a

SHA1
b31805d14b6e6f0287b90169ebb23d2c141591ca

SHA256
97cf6c4a2ac24f8835f63e69213f5183f2dc211f17526db3e71ca1d4401d8481

SHA512
ec012bc87ea9573ff0439c4c3f2981550a554398746fd7a18ec75d85f27ebec781a8445cc8522353ba3ca03f10c423210ed12115638298cfb64d22a85ab5c99d

Download Submit
\Windows\system\ErwDAuL.exe

Filesize
1.9MB

MD5
95d922dce37acc3ade4c82d5fb3abfc4

SHA1
e82d15881c19514775745bf688b6313e4056228e

SHA256
8377284f30f27a06fa757d4e41e739a6cfbca84ca253944d9278f730eb19d0a2

SHA512
73a05a66e0700465842303b5c2b12193b5b559da9956ce3d47e34b1ebb8050e6fe663f35cd99b8fdf1d2b8b7bb8a50ab2a0ef8b7673f709c89f1eb726f0b0f1d

Download Submit
\Windows\system\FgbjNaI.exe

Filesize
1.9MB

MD5
d54d6b698dee2a5f274fe9223aae39aa

SHA1
552d17b2e8a0f2eac8d07f646c850c8862484017

SHA256
47225a11259850605a6238b8f34c895be22169e66310712cc8c053638521e174

SHA512
be9b56b2842afe24c1b8135bece78ef373efbd11de462d7ec61df85ad9cce9c78e90989b0553003e443277c6add39fdf395137d161940b18ffbde7783ce83c0c

Download Submit
\Windows\system\GnUyKuB.exe

Filesize
1.9MB

MD5
77800dfced819a707bea212d7ef184d9

SHA1
d0cf1f45f6c11ea250a1596b6a63a4ea673490d6

SHA256
73b3be37e2045d6c1e40670cb8a0c5f38eca89310924a3ac53450a4dff809683

SHA512
485184f8fa9f275724ce21a275c8ba8a160a8301981bf6cd29459997538c574874200de2b2b5a15cfe062c7c4ed75100452ebb0797445f2485590abb5bbfec48

Download Submit
\Windows\system\MgEHuoB.exe

Filesize
1.9MB

MD5
c043aded48c95b185f9e9a578f9abf7f

SHA1
4ae8e9039d588a01158a8d71af3188796d2e32ab

SHA256
fb3b300029a43d8a3b77f4f390497e9bed08e2354908aa5aed7f1289de848a1d

SHA512
82595d20ee8c01f57c0dfc0f0030d3e2a28a47dd5ea15e9f508417d5b317c7030534ddea01a08977966412d1c26c154f199d37123d70b2f1d6e0f07b077f1b57

Download Submit
\Windows\system\QgpuxoJ.exe

Filesize
1.9MB

MD5
5766ee3e144252ceb637bb8ec94270e8

SHA1
d5afcbc616593afdabee29cc5621d68caf48995e

SHA256
e8f678c2ca101e075c04baf59e7b7fc79c12cbd83b235a947c57dba8e3e5009c

SHA512
8670b5202e69c079ad1cf3b33f1c67a4a6567bdda94b092ed015310869cb9d484da795356189988f3288d02c66965198b14cca7fa60424d630a1703f26b5be44

Download Submit
\Windows\system\TZgCNQo.exe

Filesize
1.9MB

MD5
3991ee5d48c185e8b7b112944c173932

SHA1
25fb11a25ed8c50fa488c96b1a3afc0fa80ba388

SHA256
78ea66f5c637545eb240122f148dbf8d3386024743db99f2ca80481e6b7a1037

SHA512
474a9d63480a2a78c595838d377eaaf7dd14a5c8c44c48803acd60e746c2f04d2ee83b0132e264dddac3e8d998848d8ea8178c09fd6048b301e9ca9b1ee8035b

Download Submit
\Windows\system\WQWVHwE.exe

Filesize
1.9MB

MD5
1e618b7b2f2a0d28109ddfd2deb806fc

SHA1
c4b6c5b37574e4ec2dc0239e7fe73d0194a6b20e

SHA256
ba9d3c99512e6215969be38c60a5b4240d6f394a1dfbaae4a47542ee89ecd231

SHA512
c8d8f0e60c50d857e825d628e4e94913a91e43584a00f545c0fcce5df5c2bb7881a48f27379f82868795cd2adec90e71cc7e175011d001dc191548f04f1e9c81

Download Submit
\Windows\system\YyJqAsB.exe

Filesize
1.9MB

MD5
6b7751ee344ecc3635c9c9c93b809512

SHA1
ec3fb965cc216bbb6f8d5d63e8d0556a2bc0fce5

SHA256
2bf5c034b3637a1fa7708aba0eaf51822c4b4a2c2f20cea73d6e30f799f90d2b

SHA512
263e278f64071676d6ee8dfee6183bc6c65302e0a0fb723399783738e2a3c590af0b18a8daccf0e642b4282310dbcfb8ccb4fb885ce40706440563e3ee75cebc

Download Submit
\Windows\system\aQXnNHS.exe

Filesize
1.9MB

MD5
88f3d004b9287320f01a7cdb2180eba4

SHA1
18cae7f8ae168f08d9312468f232a06843285d10

SHA256
60cbb41811ea243f194dd127cd97b1bdb4edff7d83db5aead41dfd0a6ebe2d7e

SHA512
1f4782766cc5fb7bacaca5e7bbb0e9af6859ab6d9af69d056b6c8ffa8a6bd8d383cc9feabea5d24fc3300bd2147d75e493eee2c4e84086b035b1a7974dfe6345

Download Submit
\Windows\system\lBxiHxX.exe

Filesize
1.9MB

MD5
8cf80d5a8370c521cee8ef5841ef3072

SHA1
a1476cd54a71a8216000479fa725a19aebcc380d

SHA256
c2f4cf125b31befc5de86ff010d690494d14f3dee56d6a8ffd33001e962ba86c

SHA512
0abfc2517762e5b4a1906ac2c190e96a18f5012bcd1be51264c6be9a3cacb22797ac8d5c7583cac5b8ec993866c7335a0121ff3a695c9790bcf166276929a0d5

Download Submit
\Windows\system\lRElpvD.exe

Filesize
1.9MB

MD5
fb58506c49a7e19d4f7e8a8488cbe21c

SHA1
97f4ba29056a082e17e5c62f244fa712111adb1e

SHA256
0b9974be4395558401c538adcad3462b0e80c93c2b65da2de03ef09f01c84e31

SHA512
ed3170000a39adb64abd8dea3950e6535145d787fa86d89f6de763ad9e5bdec1b076469aa4fd194ccc416108e6c05b5361cfadb275e60c727e64a962b9459572

Download Submit
memory/1048-104-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/1048-112-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1048-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1048-1-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/1048-12-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/1048-98-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1048-113-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/1048-102-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/1048-106-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1048-110-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1048-115-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/1048-108-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1720-111-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/1992-81-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/1992-114-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/1992-19-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/1992-69-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/1992-384-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/1992-70-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/1992-18-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2376-105-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2376-3920-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2520-3850-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2520-13-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2564-109-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2564-3928-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2632-103-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-3978-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-107-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-4002-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-101-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2640-3922-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2696-80-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download