xmrig | 1208050b692399ef453b2cb73bd8a67461894a074afdec40f43554d48354ed1a

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

092b3764ee149307d513317ec8395236_JaffaCakes118.exe
Size

1.9MB
MD5

092b3764ee149307d513317ec8395236
SHA1

98d5a2dc73b3dd10a0be08d3208292a8b41f872d
SHA256

1208050b692399ef453b2cb73bd8a67461894a074afdec40f43554d48354ed1a
SHA512

bbaa66832c45491531d3d320398fb6e647f0f1702d5e17a4b883e8204c77060e0c024ab8e8671fa79b9f01f135ea1196a9509106695b64edfff424376cf5d059
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOq:NAB3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2892-173-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2776-85-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/1264-75-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/240-73-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2624-60-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2984-58-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2536-51-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2632-50-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/3032-49-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2892-42-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2372-29-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/3032-2161-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2984-2274-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2624-2305-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2632-2302-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2536-2308-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/1264-2318-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/240-2310-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2600-2326-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/1072-2323-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/1348-2322-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2776-2266-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2372-2262-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3032	odAOnPy.exe
2624	iiBEUCY.exe
2372	yBJYtSV.exe
2776	sIGHIfC.exe
2632	rprfLTG.exe
2536	uQewJen.exe
2984	PmlrfYR.exe
240	NaztPUF.exe
1264	YTvHgEA.exe
1072	gXWUPrx.exe
1348	JEUMztC.exe
2600	OYIkFDo.exe
2704	tfTuins.exe
2768	lErTscH.exe
1636	cuoWdkg.exe
1104	GzJTTsM.exe
1156	lSRaFFT.exe
2200	BNHzQpv.exe
1128	gCvjbNu.exe
1972	ujWPsUj.exe
1344	sMEzMOq.exe
2244	yqDsQJU.exe
896	EXBTstT.exe
2304	QmuULNl.exe
324	eRjDMOV.exe
2820	fIZrxvw.exe
2992	RUKPxMM.exe
2160	RIiVJsD.exe
1248	meDXjqA.exe
268	etNkOrl.exe
1808	WvITBpU.exe
2452	KxcOPab.exe
2804	IcxAyVl.exe
2008	KEDdsRW.exe
1480	adQvXtX.exe
2004	TwxMrSt.exe
1996	soEPBzO.exe
1640	UqNMzhB.exe
1524	KPXQjeB.exe
1736	thOsXvA.exe
784	XUqdoBg.exe
1556	CZPpCBs.exe
2832	AdXueqG.exe
1004	CFUzbsD.exe
892	sYopSCs.exe
1940	MilUDXR.exe
1160	GpQjDvz.exe
1580	uVTiZpH.exe
2472	oJIAjun.exe
2264	yZyXIoS.exe
2096	OeodGMd.exe
2740	YkjrwkB.exe
2496	VWxwSPs.exe
2400	gyYMryb.exe
2996	YSKpVXd.exe
1588	cKMWCvU.exe
2712	PhRotxK.exe
1948	zFiXiTH.exe
1932	dUVCbzM.exe
1124	BApnNwC.exe
2468	atMLuLt.exe
2688	yWYCLfg.exe
2560	YccPfEV.exe
804	WIwthlR.exe

Loads dropped DLL 64 IoCs

pid	Process
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000016d11-80.dat	upx
behavioral1/memory/1348-87-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x0006000000016d55-114.dat	upx
behavioral1/files/0x0005000000018698-145.dat	upx
behavioral1/files/0x0006000000017090-139.dat	upx
behavioral1/files/0x0006000000016d89-124.dat	upx
behavioral1/files/0x0006000000016e56-129.dat	upx
behavioral1/files/0x000500000001868c-142.dat	upx
behavioral1/files/0x00050000000186a0-151.dat	upx
behavioral1/files/0x0006000000018ae8-161.dat	upx
behavioral1/files/0x0006000000018b33-171.dat	upx
behavioral1/files/0x0006000000018b15-168.dat	upx
behavioral1/files/0x0006000000018ae2-156.dat	upx
behavioral1/memory/2892-173-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x000600000001704f-135.dat	upx
behavioral1/files/0x0006000000016d84-119.dat	upx
behavioral1/files/0x0006000000016d4f-108.dat	upx
behavioral1/files/0x0006000000018b4a-195.dat	upx
behavioral1/files/0x0006000000018b42-189.dat	upx
behavioral1/files/0x0006000000018b6a-198.dat	upx
behavioral1/files/0x0006000000018b37-187.dat	upx
behavioral1/files/0x0006000000016d4a-100.dat	upx
behavioral1/files/0x0006000000016d41-96.dat	upx
behavioral1/memory/2600-93-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/files/0x0006000000016d36-91.dat	upx
behavioral1/memory/2776-85-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/1072-81-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x0006000000016d24-84.dat	upx
behavioral1/memory/1264-75-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/240-73-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x0011000000014e3d-66.dat	upx
behavioral1/files/0x0006000000016d01-69.dat	upx
behavioral1/memory/2892-61-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2624-60-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2984-58-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/files/0x0008000000015d88-55.dat	upx
behavioral1/memory/2536-51-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2632-50-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/3032-49-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/files/0x00090000000155e2-46.dat	upx
behavioral1/memory/2892-42-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2372-29-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-26.dat	upx
behavioral1/memory/2776-38-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x00080000000155d9-36.dat	upx
behavioral1/files/0x0008000000015364-23.dat	upx
behavioral1/memory/2624-16-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x002b000000014c67-14.dat	upx
behavioral1/memory/3032-9-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/files/0x000d000000014698-7.dat	upx
behavioral1/memory/2892-6-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2892-0-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/3032-2161-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2984-2274-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2624-2305-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2632-2302-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2536-2308-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/1264-2318-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/240-2310-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2600-2326-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/1072-2323-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/1348-2322-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2776-2266-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2372-2262-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\svxHOno.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\jdNzfJn.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\RAlHHCg.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\RiaeENS.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\SorzesS.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\IMnAqiC.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\KQJRTDB.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\lzrmLzn.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\zQbOGbb.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\NKFLtNz.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\UCpJdXP.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\OzjPnLs.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\gOqOsDY.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\BilJOfe.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\sELilnM.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\meDXjqA.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\sgcNckj.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\etNkOrl.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\eUXbqSc.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\fIhWJon.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\nrCyzLL.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\gByRXGj.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\XZmMWav.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\yndTyDM.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\VAyCgNl.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\tfHuIbi.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\MzswWBz.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\BZbspPo.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\JirFqWB.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\ykBCkgc.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\MpMbrSY.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\fFeDWhZ.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\ILEUDZX.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\oVVwFpl.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\DTSBajH.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\ADPaeny.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\ovXVABd.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\fbIUbAT.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\tVpDJyk.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\axurxFC.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\gVwXFGV.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\TJCuVBZ.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\aJgrqbM.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\oWaKEwp.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\NPtGILy.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\KCLCEkQ.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\PYldmRz.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\vyPikqC.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\lDEhnxk.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\IiDeLfb.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\pQNYMKp.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\IjapFQP.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\mtGJYVo.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\ycdaPsX.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\EBqOydL.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\eCotcmS.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\bhXZtlw.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\rxCWLju.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\nLSLJoW.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\JCMpbSJ.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\AepZSHH.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\vDJjGZk.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\eRJjrem.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
File created	C:\Windows\System\ERGECbm.exe	092b3764ee149307d513317ec8395236_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2680	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe
Token: SeDebugPrivilege	2680	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2680	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	29
PID 2892 wrote to memory of 2680	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	29
PID 2892 wrote to memory of 2680	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	29
PID 2892 wrote to memory of 3032	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	30
PID 2892 wrote to memory of 3032	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	30
PID 2892 wrote to memory of 3032	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	30
PID 2892 wrote to memory of 2624	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	31
PID 2892 wrote to memory of 2624	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	31
PID 2892 wrote to memory of 2624	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	31
PID 2892 wrote to memory of 2372	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	32
PID 2892 wrote to memory of 2372	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	32
PID 2892 wrote to memory of 2372	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	32
PID 2892 wrote to memory of 2632	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	33
PID 2892 wrote to memory of 2632	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	33
PID 2892 wrote to memory of 2632	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	33
PID 2892 wrote to memory of 2776	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	34
PID 2892 wrote to memory of 2776	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	34
PID 2892 wrote to memory of 2776	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	34
PID 2892 wrote to memory of 2536	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	35
PID 2892 wrote to memory of 2536	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	35
PID 2892 wrote to memory of 2536	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	35
PID 2892 wrote to memory of 2984	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	36
PID 2892 wrote to memory of 2984	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	36
PID 2892 wrote to memory of 2984	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	36
PID 2892 wrote to memory of 240	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	37
PID 2892 wrote to memory of 240	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	37
PID 2892 wrote to memory of 240	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	37
PID 2892 wrote to memory of 1264	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	38
PID 2892 wrote to memory of 1264	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	38
PID 2892 wrote to memory of 1264	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	38
PID 2892 wrote to memory of 1072	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	39
PID 2892 wrote to memory of 1072	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	39
PID 2892 wrote to memory of 1072	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	39
PID 2892 wrote to memory of 1348	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	40
PID 2892 wrote to memory of 1348	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	40
PID 2892 wrote to memory of 1348	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	40
PID 2892 wrote to memory of 2600	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	41
PID 2892 wrote to memory of 2600	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	41
PID 2892 wrote to memory of 2600	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	41
PID 2892 wrote to memory of 2704	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	42
PID 2892 wrote to memory of 2704	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	42
PID 2892 wrote to memory of 2704	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	42
PID 2892 wrote to memory of 2768	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	43
PID 2892 wrote to memory of 2768	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	43
PID 2892 wrote to memory of 2768	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	43
PID 2892 wrote to memory of 1636	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	44
PID 2892 wrote to memory of 1636	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	44
PID 2892 wrote to memory of 1636	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	44
PID 2892 wrote to memory of 1104	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	45
PID 2892 wrote to memory of 1104	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	45
PID 2892 wrote to memory of 1104	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	45
PID 2892 wrote to memory of 1156	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	46
PID 2892 wrote to memory of 1156	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	46
PID 2892 wrote to memory of 1156	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	46
PID 2892 wrote to memory of 2200	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	47
PID 2892 wrote to memory of 2200	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	47
PID 2892 wrote to memory of 2200	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	47
PID 2892 wrote to memory of 1128	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	48
PID 2892 wrote to memory of 1128	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	48
PID 2892 wrote to memory of 1128	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	48
PID 2892 wrote to memory of 1972	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	49
PID 2892 wrote to memory of 1972	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	49
PID 2892 wrote to memory of 1972	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	49
PID 2892 wrote to memory of 1344	2892	092b3764ee149307d513317ec8395236_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\092b3764ee149307d513317ec8395236_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\092b3764ee149307d513317ec8395236_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\System\odAOnPy.exe
  C:\Windows\System\odAOnPy.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\iiBEUCY.exe
  C:\Windows\System\iiBEUCY.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\yBJYtSV.exe
  C:\Windows\System\yBJYtSV.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\rprfLTG.exe
  C:\Windows\System\rprfLTG.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\sIGHIfC.exe
  C:\Windows\System\sIGHIfC.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\uQewJen.exe
  C:\Windows\System\uQewJen.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\PmlrfYR.exe
  C:\Windows\System\PmlrfYR.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\NaztPUF.exe
  C:\Windows\System\NaztPUF.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\YTvHgEA.exe
  C:\Windows\System\YTvHgEA.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\gXWUPrx.exe
  C:\Windows\System\gXWUPrx.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\JEUMztC.exe
  C:\Windows\System\JEUMztC.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\OYIkFDo.exe
  C:\Windows\System\OYIkFDo.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\tfTuins.exe
  C:\Windows\System\tfTuins.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\lErTscH.exe
  C:\Windows\System\lErTscH.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\cuoWdkg.exe
  C:\Windows\System\cuoWdkg.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\GzJTTsM.exe
  C:\Windows\System\GzJTTsM.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\lSRaFFT.exe
  C:\Windows\System\lSRaFFT.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\BNHzQpv.exe
  C:\Windows\System\BNHzQpv.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\gCvjbNu.exe
  C:\Windows\System\gCvjbNu.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\ujWPsUj.exe
  C:\Windows\System\ujWPsUj.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\sMEzMOq.exe
  C:\Windows\System\sMEzMOq.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\yqDsQJU.exe
  C:\Windows\System\yqDsQJU.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\EXBTstT.exe
  C:\Windows\System\EXBTstT.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\eRjDMOV.exe
  C:\Windows\System\eRjDMOV.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\QmuULNl.exe
  C:\Windows\System\QmuULNl.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\fIZrxvw.exe
  C:\Windows\System\fIZrxvw.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\RUKPxMM.exe
  C:\Windows\System\RUKPxMM.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\etNkOrl.exe
  C:\Windows\System\etNkOrl.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\RIiVJsD.exe
  C:\Windows\System\RIiVJsD.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\WvITBpU.exe
  C:\Windows\System\WvITBpU.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\meDXjqA.exe
  C:\Windows\System\meDXjqA.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\KxcOPab.exe
  C:\Windows\System\KxcOPab.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\IcxAyVl.exe
  C:\Windows\System\IcxAyVl.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\adQvXtX.exe
  C:\Windows\System\adQvXtX.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\KEDdsRW.exe
  C:\Windows\System\KEDdsRW.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\TwxMrSt.exe
  C:\Windows\System\TwxMrSt.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\soEPBzO.exe
  C:\Windows\System\soEPBzO.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\XUqdoBg.exe
  C:\Windows\System\XUqdoBg.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\UqNMzhB.exe
  C:\Windows\System\UqNMzhB.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\CZPpCBs.exe
  C:\Windows\System\CZPpCBs.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\KPXQjeB.exe
  C:\Windows\System\KPXQjeB.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\AdXueqG.exe
  C:\Windows\System\AdXueqG.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\thOsXvA.exe
  C:\Windows\System\thOsXvA.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\CFUzbsD.exe
  C:\Windows\System\CFUzbsD.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\sYopSCs.exe
  C:\Windows\System\sYopSCs.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\MilUDXR.exe
  C:\Windows\System\MilUDXR.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\GpQjDvz.exe
  C:\Windows\System\GpQjDvz.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\yZyXIoS.exe
  C:\Windows\System\yZyXIoS.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\uVTiZpH.exe
  C:\Windows\System\uVTiZpH.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\OeodGMd.exe
  C:\Windows\System\OeodGMd.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\oJIAjun.exe
  C:\Windows\System\oJIAjun.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\VWxwSPs.exe
  C:\Windows\System\VWxwSPs.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\YkjrwkB.exe
  C:\Windows\System\YkjrwkB.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\gyYMryb.exe
  C:\Windows\System\gyYMryb.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\YSKpVXd.exe
  C:\Windows\System\YSKpVXd.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\cKMWCvU.exe
  C:\Windows\System\cKMWCvU.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\PhRotxK.exe
  C:\Windows\System\PhRotxK.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\zFiXiTH.exe
  C:\Windows\System\zFiXiTH.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\dUVCbzM.exe
  C:\Windows\System\dUVCbzM.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\yWYCLfg.exe
  C:\Windows\System\yWYCLfg.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\BApnNwC.exe
  C:\Windows\System\BApnNwC.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\WIwthlR.exe
  C:\Windows\System\WIwthlR.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\atMLuLt.exe
  C:\Windows\System\atMLuLt.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\WmzSbLj.exe
  C:\Windows\System\WmzSbLj.exe
  2⤵
  PID:956
- C:\Windows\System\YccPfEV.exe
  C:\Windows\System\YccPfEV.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\wlEUmpt.exe
  C:\Windows\System\wlEUmpt.exe
  2⤵
  PID:2240
- C:\Windows\System\DNxpALP.exe
  C:\Windows\System\DNxpALP.exe
  2⤵
  PID:700
- C:\Windows\System\svxHOno.exe
  C:\Windows\System\svxHOno.exe
  2⤵
  PID:1760
- C:\Windows\System\FUdslFB.exe
  C:\Windows\System\FUdslFB.exe
  2⤵
  PID:1784
- C:\Windows\System\oVMUNMJ.exe
  C:\Windows\System\oVMUNMJ.exe
  2⤵
  PID:2548
- C:\Windows\System\hmNxgXQ.exe
  C:\Windows\System\hmNxgXQ.exe
  2⤵
  PID:2972
- C:\Windows\System\EsBabNp.exe
  C:\Windows\System\EsBabNp.exe
  2⤵
  PID:1656
- C:\Windows\System\eUXbqSc.exe
  C:\Windows\System\eUXbqSc.exe
  2⤵
  PID:3048
- C:\Windows\System\IWeGiAj.exe
  C:\Windows\System\IWeGiAj.exe
  2⤵
  PID:2852
- C:\Windows\System\bydJrCh.exe
  C:\Windows\System\bydJrCh.exe
  2⤵
  PID:2812
- C:\Windows\System\FRpDVpm.exe
  C:\Windows\System\FRpDVpm.exe
  2⤵
  PID:2516
- C:\Windows\System\RvWSnHg.exe
  C:\Windows\System\RvWSnHg.exe
  2⤵
  PID:2588
- C:\Windows\System\slDctot.exe
  C:\Windows\System\slDctot.exe
  2⤵
  PID:1068
- C:\Windows\System\OOtBZZx.exe
  C:\Windows\System\OOtBZZx.exe
  2⤵
  PID:2696
- C:\Windows\System\lUEPmLE.exe
  C:\Windows\System\lUEPmLE.exe
  2⤵
  PID:2844
- C:\Windows\System\ivNShlj.exe
  C:\Windows\System\ivNShlj.exe
  2⤵
  PID:1956
- C:\Windows\System\WGoewnY.exe
  C:\Windows\System\WGoewnY.exe
  2⤵
  PID:2052
- C:\Windows\System\yGDZqXd.exe
  C:\Windows\System\yGDZqXd.exe
  2⤵
  PID:2280
- C:\Windows\System\WUJgRtU.exe
  C:\Windows\System\WUJgRtU.exe
  2⤵
  PID:2756
- C:\Windows\System\zyEHGNg.exe
  C:\Windows\System\zyEHGNg.exe
  2⤵
  PID:2612
- C:\Windows\System\JgUPHFJ.exe
  C:\Windows\System\JgUPHFJ.exe
  2⤵
  PID:436
- C:\Windows\System\wSJJCkE.exe
  C:\Windows\System\wSJJCkE.exe
  2⤵
  PID:1920
- C:\Windows\System\hpOPCKG.exe
  C:\Windows\System\hpOPCKG.exe
  2⤵
  PID:2512
- C:\Windows\System\IwFwtWn.exe
  C:\Windows\System\IwFwtWn.exe
  2⤵
  PID:2460
- C:\Windows\System\rSjBbUo.exe
  C:\Windows\System\rSjBbUo.exe
  2⤵
  PID:2748
- C:\Windows\System\TRhEfos.exe
  C:\Windows\System\TRhEfos.exe
  2⤵
  PID:1060
- C:\Windows\System\jAqUigZ.exe
  C:\Windows\System\jAqUigZ.exe
  2⤵
  PID:2080
- C:\Windows\System\lnqpwfT.exe
  C:\Windows\System\lnqpwfT.exe
  2⤵
  PID:1484
- C:\Windows\System\ObQkVVl.exe
  C:\Windows\System\ObQkVVl.exe
  2⤵
  PID:564
- C:\Windows\System\BgMxntD.exe
  C:\Windows\System\BgMxntD.exe
  2⤵
  PID:2828
- C:\Windows\System\bbYAaym.exe
  C:\Windows\System\bbYAaym.exe
  2⤵
  PID:2016
- C:\Windows\System\wotZXhB.exe
  C:\Windows\System\wotZXhB.exe
  2⤵
  PID:2020
- C:\Windows\System\FadzPUq.exe
  C:\Windows\System\FadzPUq.exe
  2⤵
  PID:2140
- C:\Windows\System\feMTguu.exe
  C:\Windows\System\feMTguu.exe
  2⤵
  PID:3000
- C:\Windows\System\ETXErpv.exe
  C:\Windows\System\ETXErpv.exe
  2⤵
  PID:2788
- C:\Windows\System\PlOzGaF.exe
  C:\Windows\System\PlOzGaF.exe
  2⤵
  PID:2540
- C:\Windows\System\hSQlcBX.exe
  C:\Windows\System\hSQlcBX.exe
  2⤵
  PID:1616
- C:\Windows\System\EabcPBW.exe
  C:\Windows\System\EabcPBW.exe
  2⤵
  PID:2328
- C:\Windows\System\jdNzfJn.exe
  C:\Windows\System\jdNzfJn.exe
  2⤵
  PID:580
- C:\Windows\System\WyFdAID.exe
  C:\Windows\System\WyFdAID.exe
  2⤵
  PID:2900
- C:\Windows\System\GgqCcdJ.exe
  C:\Windows\System\GgqCcdJ.exe
  2⤵
  PID:2792
- C:\Windows\System\SXynyxn.exe
  C:\Windows\System\SXynyxn.exe
  2⤵
  PID:592
- C:\Windows\System\vRuJJyc.exe
  C:\Windows\System\vRuJJyc.exe
  2⤵
  PID:1652
- C:\Windows\System\BEUWkGS.exe
  C:\Windows\System\BEUWkGS.exe
  2⤵
  PID:968
- C:\Windows\System\QOjDWwq.exe
  C:\Windows\System\QOjDWwq.exe
  2⤵
  PID:1472
- C:\Windows\System\AeGOcLl.exe
  C:\Windows\System\AeGOcLl.exe
  2⤵
  PID:644
- C:\Windows\System\rSMZZEC.exe
  C:\Windows\System\rSMZZEC.exe
  2⤵
  PID:2572
- C:\Windows\System\LnWuBgB.exe
  C:\Windows\System\LnWuBgB.exe
  2⤵
  PID:368
- C:\Windows\System\cBCUECk.exe
  C:\Windows\System\cBCUECk.exe
  2⤵
  PID:1980
- C:\Windows\System\znZTjXV.exe
  C:\Windows\System\znZTjXV.exe
  2⤵
  PID:764
- C:\Windows\System\tBINjyC.exe
  C:\Windows\System\tBINjyC.exe
  2⤵
  PID:2716
- C:\Windows\System\mSCiKZP.exe
  C:\Windows\System\mSCiKZP.exe
  2⤵
  PID:2576
- C:\Windows\System\OdhKHEE.exe
  C:\Windows\System\OdhKHEE.exe
  2⤵
  PID:2224
- C:\Windows\System\FAUtlWp.exe
  C:\Windows\System\FAUtlWp.exe
  2⤵
  PID:2464
- C:\Windows\System\kxEXeyH.exe
  C:\Windows\System\kxEXeyH.exe
  2⤵
  PID:2068
- C:\Windows\System\IbTZKfr.exe
  C:\Windows\System\IbTZKfr.exe
  2⤵
  PID:2172
- C:\Windows\System\dHIQzGn.exe
  C:\Windows\System\dHIQzGn.exe
  2⤵
  PID:2492
- C:\Windows\System\NsLOUFs.exe
  C:\Windows\System\NsLOUFs.exe
  2⤵
  PID:2668
- C:\Windows\System\YQSkFcL.exe
  C:\Windows\System\YQSkFcL.exe
  2⤵
  PID:1532
- C:\Windows\System\tVpDJyk.exe
  C:\Windows\System\tVpDJyk.exe
  2⤵
  PID:2136
- C:\Windows\System\JzaIQBA.exe
  C:\Windows\System\JzaIQBA.exe
  2⤵
  PID:2348
- C:\Windows\System\knpgKJB.exe
  C:\Windows\System\knpgKJB.exe
  2⤵
  PID:2156
- C:\Windows\System\axurxFC.exe
  C:\Windows\System\axurxFC.exe
  2⤵
  PID:2044
- C:\Windows\System\DpxAMbG.exe
  C:\Windows\System\DpxAMbG.exe
  2⤵
  PID:1724
- C:\Windows\System\wYuobIS.exe
  C:\Windows\System\wYuobIS.exe
  2⤵
  PID:2544
- C:\Windows\System\JpsXuqE.exe
  C:\Windows\System\JpsXuqE.exe
  2⤵
  PID:2380
- C:\Windows\System\wkfjCRX.exe
  C:\Windows\System\wkfjCRX.exe
  2⤵
  PID:1544
- C:\Windows\System\qBebexY.exe
  C:\Windows\System\qBebexY.exe
  2⤵
  PID:696
- C:\Windows\System\NoaAaya.exe
  C:\Windows\System\NoaAaya.exe
  2⤵
  PID:1756
- C:\Windows\System\qtJHCnh.exe
  C:\Windows\System\qtJHCnh.exe
  2⤵
  PID:1180
- C:\Windows\System\VyogvoO.exe
  C:\Windows\System\VyogvoO.exe
  2⤵
  PID:2960
- C:\Windows\System\zvmCVYx.exe
  C:\Windows\System\zvmCVYx.exe
  2⤵
  PID:2404
- C:\Windows\System\ElMBspW.exe
  C:\Windows\System\ElMBspW.exe
  2⤵
  PID:1684
- C:\Windows\System\aoPbVBT.exe
  C:\Windows\System\aoPbVBT.exe
  2⤵
  PID:912
- C:\Windows\System\ndpTeoV.exe
  C:\Windows\System\ndpTeoV.exe
  2⤵
  PID:2424
- C:\Windows\System\XZmMWav.exe
  C:\Windows\System\XZmMWav.exe
  2⤵
  PID:2444
- C:\Windows\System\aJDJGpd.exe
  C:\Windows\System\aJDJGpd.exe
  2⤵
  PID:2664
- C:\Windows\System\cICjfbQ.exe
  C:\Windows\System\cICjfbQ.exe
  2⤵
  PID:1904
- C:\Windows\System\NmCbHIs.exe
  C:\Windows\System\NmCbHIs.exe
  2⤵
  PID:1688
- C:\Windows\System\tasWlut.exe
  C:\Windows\System\tasWlut.exe
  2⤵
  PID:2376
- C:\Windows\System\RrfKeoc.exe
  C:\Windows\System\RrfKeoc.exe
  2⤵
  PID:3036
- C:\Windows\System\lntRUXp.exe
  C:\Windows\System\lntRUXp.exe
  2⤵
  PID:3024
- C:\Windows\System\RBnheyv.exe
  C:\Windows\System\RBnheyv.exe
  2⤵
  PID:1832
- C:\Windows\System\jMxskfG.exe
  C:\Windows\System\jMxskfG.exe
  2⤵
  PID:1708
- C:\Windows\System\qxtpoZT.exe
  C:\Windows\System\qxtpoZT.exe
  2⤵
  PID:2760
- C:\Windows\System\DQNnsnr.exe
  C:\Windows\System\DQNnsnr.exe
  2⤵
  PID:1576
- C:\Windows\System\xajKTYP.exe
  C:\Windows\System\xajKTYP.exe
  2⤵
  PID:1712
- C:\Windows\System\LORnYLW.exe
  C:\Windows\System\LORnYLW.exe
  2⤵
  PID:2028
- C:\Windows\System\IYgpnQH.exe
  C:\Windows\System\IYgpnQH.exe
  2⤵
  PID:708
- C:\Windows\System\qCbTcDw.exe
  C:\Windows\System\qCbTcDw.exe
  2⤵
  PID:2196
- C:\Windows\System\uKOPQyj.exe
  C:\Windows\System\uKOPQyj.exe
  2⤵
  PID:2012
- C:\Windows\System\GPABGVq.exe
  C:\Windows\System\GPABGVq.exe
  2⤵
  PID:1236
- C:\Windows\System\iqBULtk.exe
  C:\Windows\System\iqBULtk.exe
  2⤵
  PID:2508
- C:\Windows\System\zAEyQBb.exe
  C:\Windows\System\zAEyQBb.exe
  2⤵
  PID:2932
- C:\Windows\System\miuPUBx.exe
  C:\Windows\System\miuPUBx.exe
  2⤵
  PID:2556
- C:\Windows\System\eDiekiX.exe
  C:\Windows\System\eDiekiX.exe
  2⤵
  PID:2024
- C:\Windows\System\tkzMdNV.exe
  C:\Windows\System\tkzMdNV.exe
  2⤵
  PID:2388
- C:\Windows\System\SBUJQYG.exe
  C:\Windows\System\SBUJQYG.exe
  2⤵
  PID:2752
- C:\Windows\System\IZdgvdQ.exe
  C:\Windows\System\IZdgvdQ.exe
  2⤵
  PID:1664
- C:\Windows\System\DOqMOoB.exe
  C:\Windows\System\DOqMOoB.exe
  2⤵
  PID:2056
- C:\Windows\System\dmmsCtN.exe
  C:\Windows\System\dmmsCtN.exe
  2⤵
  PID:2256
- C:\Windows\System\fMZwbFe.exe
  C:\Windows\System\fMZwbFe.exe
  2⤵
  PID:2504
- C:\Windows\System\ISGGkYe.exe
  C:\Windows\System\ISGGkYe.exe
  2⤵
  PID:2856
- C:\Windows\System\RETylrE.exe
  C:\Windows\System\RETylrE.exe
  2⤵
  PID:2408
- C:\Windows\System\qYDAlDv.exe
  C:\Windows\System\qYDAlDv.exe
  2⤵
  PID:3044
- C:\Windows\System\TpsYIJS.exe
  C:\Windows\System\TpsYIJS.exe
  2⤵
  PID:1564
- C:\Windows\System\WghiNVT.exe
  C:\Windows\System\WghiNVT.exe
  2⤵
  PID:904
- C:\Windows\System\nbhodYj.exe
  C:\Windows\System\nbhodYj.exe
  2⤵
  PID:1536
- C:\Windows\System\cpCWapK.exe
  C:\Windows\System\cpCWapK.exe
  2⤵
  PID:2064
- C:\Windows\System\RpncyTt.exe
  C:\Windows\System\RpncyTt.exe
  2⤵
  PID:868
- C:\Windows\System\ahZJWzm.exe
  C:\Windows\System\ahZJWzm.exe
  2⤵
  PID:984
- C:\Windows\System\mPyayvg.exe
  C:\Windows\System\mPyayvg.exe
  2⤵
  PID:1436
- C:\Windows\System\DAqZgmm.exe
  C:\Windows\System\DAqZgmm.exe
  2⤵
  PID:2132
- C:\Windows\System\DyAvXjG.exe
  C:\Windows\System\DyAvXjG.exe
  2⤵
  PID:3076
- C:\Windows\System\YHntdCe.exe
  C:\Windows\System\YHntdCe.exe
  2⤵
  PID:3092
- C:\Windows\System\cAXFjgC.exe
  C:\Windows\System\cAXFjgC.exe
  2⤵
  PID:3108
- C:\Windows\System\MMGcsOk.exe
  C:\Windows\System\MMGcsOk.exe
  2⤵
  PID:3124
- C:\Windows\System\qBCZaaD.exe
  C:\Windows\System\qBCZaaD.exe
  2⤵
  PID:3140
- C:\Windows\System\VgumJPG.exe
  C:\Windows\System\VgumJPG.exe
  2⤵
  PID:3160
- C:\Windows\System\RUgOvsi.exe
  C:\Windows\System\RUgOvsi.exe
  2⤵
  PID:3176
- C:\Windows\System\RBbjXzm.exe
  C:\Windows\System\RBbjXzm.exe
  2⤵
  PID:3192
- C:\Windows\System\TqUjxNw.exe
  C:\Windows\System\TqUjxNw.exe
  2⤵
  PID:3212
- C:\Windows\System\aeVBFWI.exe
  C:\Windows\System\aeVBFWI.exe
  2⤵
  PID:3228
- C:\Windows\System\nzcNhrN.exe
  C:\Windows\System\nzcNhrN.exe
  2⤵
  PID:3244
- C:\Windows\System\ywYqYdK.exe
  C:\Windows\System\ywYqYdK.exe
  2⤵
  PID:3264
- C:\Windows\System\mRhpHjr.exe
  C:\Windows\System\mRhpHjr.exe
  2⤵
  PID:3280
- C:\Windows\System\DMPYrBB.exe
  C:\Windows\System\DMPYrBB.exe
  2⤵
  PID:3344
- C:\Windows\System\FdNVvql.exe
  C:\Windows\System\FdNVvql.exe
  2⤵
  PID:3360
- C:\Windows\System\sodDwVq.exe
  C:\Windows\System\sodDwVq.exe
  2⤵
  PID:3380
- C:\Windows\System\EjhWbEy.exe
  C:\Windows\System\EjhWbEy.exe
  2⤵
  PID:3396
- C:\Windows\System\ETRLLWl.exe
  C:\Windows\System\ETRLLWl.exe
  2⤵
  PID:3416
- C:\Windows\System\tLmjqkz.exe
  C:\Windows\System\tLmjqkz.exe
  2⤵
  PID:3436
- C:\Windows\System\RpQboFl.exe
  C:\Windows\System\RpQboFl.exe
  2⤵
  PID:3456
- C:\Windows\System\mWGlGPX.exe
  C:\Windows\System\mWGlGPX.exe
  2⤵
  PID:3472
- C:\Windows\System\YeCphPb.exe
  C:\Windows\System\YeCphPb.exe
  2⤵
  PID:3488
- C:\Windows\System\TsyFsTk.exe
  C:\Windows\System\TsyFsTk.exe
  2⤵
  PID:3504
- C:\Windows\System\agsOVAg.exe
  C:\Windows\System\agsOVAg.exe
  2⤵
  PID:3520
- C:\Windows\System\SSIKjPr.exe
  C:\Windows\System\SSIKjPr.exe
  2⤵
  PID:3536
- C:\Windows\System\obmywLX.exe
  C:\Windows\System\obmywLX.exe
  2⤵
  PID:3552
- C:\Windows\System\eXoLZEz.exe
  C:\Windows\System\eXoLZEz.exe
  2⤵
  PID:3568
- C:\Windows\System\DHjddDk.exe
  C:\Windows\System\DHjddDk.exe
  2⤵
  PID:3584
- C:\Windows\System\YNUhleV.exe
  C:\Windows\System\YNUhleV.exe
  2⤵
  PID:3600
- C:\Windows\System\yVqyQcA.exe
  C:\Windows\System\yVqyQcA.exe
  2⤵
  PID:3616
- C:\Windows\System\sLIeLfS.exe
  C:\Windows\System\sLIeLfS.exe
  2⤵
  PID:3632
- C:\Windows\System\RhwsYER.exe
  C:\Windows\System\RhwsYER.exe
  2⤵
  PID:3648
- C:\Windows\System\BouKxiJ.exe
  C:\Windows\System\BouKxiJ.exe
  2⤵
  PID:3668
- C:\Windows\System\oDXNJws.exe
  C:\Windows\System\oDXNJws.exe
  2⤵
  PID:3684
- C:\Windows\System\ZXhioIh.exe
  C:\Windows\System\ZXhioIh.exe
  2⤵
  PID:3700
- C:\Windows\System\LJabteH.exe
  C:\Windows\System\LJabteH.exe
  2⤵
  PID:3720
- C:\Windows\System\BwOlUiU.exe
  C:\Windows\System\BwOlUiU.exe
  2⤵
  PID:3736
- C:\Windows\System\yPChbNU.exe
  C:\Windows\System\yPChbNU.exe
  2⤵
  PID:3752
- C:\Windows\System\heBSQCw.exe
  C:\Windows\System\heBSQCw.exe
  2⤵
  PID:3772
- C:\Windows\System\nrCyzLL.exe
  C:\Windows\System\nrCyzLL.exe
  2⤵
  PID:3788
- C:\Windows\System\PASDIpc.exe
  C:\Windows\System\PASDIpc.exe
  2⤵
  PID:3804
- C:\Windows\System\FXLSSNX.exe
  C:\Windows\System\FXLSSNX.exe
  2⤵
  PID:3824
- C:\Windows\System\QnEEuBG.exe
  C:\Windows\System\QnEEuBG.exe
  2⤵
  PID:3840
- C:\Windows\System\lPZFSqN.exe
  C:\Windows\System\lPZFSqN.exe
  2⤵
  PID:3856
- C:\Windows\System\pOZXuym.exe
  C:\Windows\System\pOZXuym.exe
  2⤵
  PID:3872
- C:\Windows\System\RiHbSaU.exe
  C:\Windows\System\RiHbSaU.exe
  2⤵
  PID:4048
- C:\Windows\System\YIrCXIf.exe
  C:\Windows\System\YIrCXIf.exe
  2⤵
  PID:4068
- C:\Windows\System\yiMcHKD.exe
  C:\Windows\System\yiMcHKD.exe
  2⤵
  PID:4084
- C:\Windows\System\hxOWfGq.exe
  C:\Windows\System\hxOWfGq.exe
  2⤵
  PID:1064
- C:\Windows\System\reHfFJP.exe
  C:\Windows\System\reHfFJP.exe
  2⤵
  PID:2848
- C:\Windows\System\hcFLhBs.exe
  C:\Windows\System\hcFLhBs.exe
  2⤵
  PID:2316
- C:\Windows\System\gVwXFGV.exe
  C:\Windows\System\gVwXFGV.exe
  2⤵
  PID:2416
- C:\Windows\System\BkPfdGw.exe
  C:\Windows\System\BkPfdGw.exe
  2⤵
  PID:2480
- C:\Windows\System\HUdAQht.exe
  C:\Windows\System\HUdAQht.exe
  2⤵
  PID:3204
- C:\Windows\System\XJpHLmO.exe
  C:\Windows\System\XJpHLmO.exe
  2⤵
  PID:2912
- C:\Windows\System\qYDUWXy.exe
  C:\Windows\System\qYDUWXy.exe
  2⤵
  PID:3016
- C:\Windows\System\moUiFpB.exe
  C:\Windows\System\moUiFpB.exe
  2⤵
  PID:3236
- C:\Windows\System\BZkLhJf.exe
  C:\Windows\System\BZkLhJf.exe
  2⤵
  PID:3184
- C:\Windows\System\rMUQKxh.exe
  C:\Windows\System\rMUQKxh.exe
  2⤵
  PID:3188
- C:\Windows\System\mzIsDzb.exe
  C:\Windows\System\mzIsDzb.exe
  2⤵
  PID:3136
- C:\Windows\System\RQxmZjs.exe
  C:\Windows\System\RQxmZjs.exe
  2⤵
  PID:3288
- C:\Windows\System\FnIibky.exe
  C:\Windows\System\FnIibky.exe
  2⤵
  PID:3660
- C:\Windows\System\ACWVQye.exe
  C:\Windows\System\ACWVQye.exe
  2⤵
  PID:3656
- C:\Windows\System\npFMwhR.exe
  C:\Windows\System\npFMwhR.exe
  2⤵
  PID:3312
- C:\Windows\System\EqeJSlo.exe
  C:\Windows\System\EqeJSlo.exe
  2⤵
  PID:3332
- C:\Windows\System\VbGhcWo.exe
  C:\Windows\System\VbGhcWo.exe
  2⤵
  PID:3372
- C:\Windows\System\MbanviI.exe
  C:\Windows\System\MbanviI.exe
  2⤵
  PID:3408
- C:\Windows\System\AojyyiJ.exe
  C:\Windows\System\AojyyiJ.exe
  2⤵
  PID:3452
- C:\Windows\System\WksUEWv.exe
  C:\Windows\System\WksUEWv.exe
  2⤵
  PID:3544
- C:\Windows\System\ronHOUh.exe
  C:\Windows\System\ronHOUh.exe
  2⤵
  PID:3640
- C:\Windows\System\oUOfOvX.exe
  C:\Windows\System\oUOfOvX.exe
  2⤵
  PID:3744
- C:\Windows\System\eRhjyLm.exe
  C:\Windows\System\eRhjyLm.exe
  2⤵
  PID:3820
- C:\Windows\System\CsqiRHc.exe
  C:\Windows\System\CsqiRHc.exe
  2⤵
  PID:3884
- C:\Windows\System\KiISWdL.exe
  C:\Windows\System\KiISWdL.exe
  2⤵
  PID:3356
- C:\Windows\System\hOhYXCP.exe
  C:\Windows\System\hOhYXCP.exe
  2⤵
  PID:3964
- C:\Windows\System\ypXElrm.exe
  C:\Windows\System\ypXElrm.exe
  2⤵
  PID:3424
- C:\Windows\System\PNWKOOy.exe
  C:\Windows\System\PNWKOOy.exe
  2⤵
  PID:3628
- C:\Windows\System\osSIEkd.exe
  C:\Windows\System\osSIEkd.exe
  2⤵
  PID:3800
- C:\Windows\System\iAqRyWS.exe
  C:\Windows\System\iAqRyWS.exe
  2⤵
  PID:3432
- C:\Windows\System\aJvfHAv.exe
  C:\Windows\System\aJvfHAv.exe
  2⤵
  PID:3760
- C:\Windows\System\pUMcoVI.exe
  C:\Windows\System\pUMcoVI.exe
  2⤵
  PID:3980
- C:\Windows\System\eFHyNxB.exe
  C:\Windows\System\eFHyNxB.exe
  2⤵
  PID:3992
- C:\Windows\System\RZTpxWj.exe
  C:\Windows\System\RZTpxWj.exe
  2⤵
  PID:3428
- C:\Windows\System\YGWNkNu.exe
  C:\Windows\System\YGWNkNu.exe
  2⤵
  PID:3328
- C:\Windows\System\yqmyKZU.exe
  C:\Windows\System\yqmyKZU.exe
  2⤵
  PID:2208
- C:\Windows\System\jmOrnzM.exe
  C:\Windows\System\jmOrnzM.exe
  2⤵
  PID:2084
- C:\Windows\System\PEaIJna.exe
  C:\Windows\System\PEaIJna.exe
  2⤵
  PID:3368
- C:\Windows\System\BpaNxBT.exe
  C:\Windows\System\BpaNxBT.exe
  2⤵
  PID:3624
- C:\Windows\System\zlHjPrC.exe
  C:\Windows\System\zlHjPrC.exe
  2⤵
  PID:3780
- C:\Windows\System\cELRYjL.exe
  C:\Windows\System\cELRYjL.exe
  2⤵
  PID:3708
- C:\Windows\System\KeZYDsu.exe
  C:\Windows\System\KeZYDsu.exe
  2⤵
  PID:1728
- C:\Windows\System\joQdAxo.exe
  C:\Windows\System\joQdAxo.exe
  2⤵
  PID:3148
- C:\Windows\System\cJuHtZZ.exe
  C:\Windows\System\cJuHtZZ.exe
  2⤵
  PID:3904
- C:\Windows\System\IoztXOR.exe
  C:\Windows\System\IoztXOR.exe
  2⤵
  PID:3260
- C:\Windows\System\usERGZw.exe
  C:\Windows\System\usERGZw.exe
  2⤵
  PID:3304
- C:\Windows\System\ywEYGui.exe
  C:\Windows\System\ywEYGui.exe
  2⤵
  PID:3576
- C:\Windows\System\TiYQVsp.exe
  C:\Windows\System\TiYQVsp.exe
  2⤵
  PID:3580
- C:\Windows\System\lluZozT.exe
  C:\Windows\System\lluZozT.exe
  2⤵
  PID:3892
- C:\Windows\System\HuvHYPj.exe
  C:\Windows\System\HuvHYPj.exe
  2⤵
  PID:3972
- C:\Windows\System\zXUZQsm.exe
  C:\Windows\System\zXUZQsm.exe
  2⤵
  PID:3596
- C:\Windows\System\HeOmYrY.exe
  C:\Windows\System\HeOmYrY.exe
  2⤵
  PID:4036
- C:\Windows\System\NlgXOQl.exe
  C:\Windows\System\NlgXOQl.exe
  2⤵
  PID:3008
- C:\Windows\System\OBdslUg.exe
  C:\Windows\System\OBdslUg.exe
  2⤵
  PID:3320
- C:\Windows\System\mDLRtsX.exe
  C:\Windows\System\mDLRtsX.exe
  2⤵
  PID:3716
- C:\Windows\System\wuYkERp.exe
  C:\Windows\System\wuYkERp.exe
  2⤵
  PID:948
- C:\Windows\System\XLUFxsB.exe
  C:\Windows\System\XLUFxsB.exe
  2⤵
  PID:3916
- C:\Windows\System\bsesWoa.exe
  C:\Windows\System\bsesWoa.exe
  2⤵
  PID:3924
- C:\Windows\System\nWSYaHI.exe
  C:\Windows\System\nWSYaHI.exe
  2⤵
  PID:3836
- C:\Windows\System\JoRPtvD.exe
  C:\Windows\System\JoRPtvD.exe
  2⤵
  PID:3956
- C:\Windows\System\JjtuaGg.exe
  C:\Windows\System\JjtuaGg.exe
  2⤵
  PID:4076
- C:\Windows\System\tQHKged.exe
  C:\Windows\System\tQHKged.exe
  2⤵
  PID:3920
- C:\Windows\System\gNTMgUy.exe
  C:\Windows\System\gNTMgUy.exe
  2⤵
  PID:1924
- C:\Windows\System\etGEJyy.exe
  C:\Windows\System\etGEJyy.exe
  2⤵
  PID:3676
- C:\Windows\System\tBpCcyk.exe
  C:\Windows\System\tBpCcyk.exe
  2⤵
  PID:3100
- C:\Windows\System\DrZMYHY.exe
  C:\Windows\System\DrZMYHY.exe
  2⤵
  PID:3960
- C:\Windows\System\TfGOZwj.exe
  C:\Windows\System\TfGOZwj.exe
  2⤵
  PID:4016
- C:\Windows\System\SsqaIwI.exe
  C:\Windows\System\SsqaIwI.exe
  2⤵
  PID:3156
- C:\Windows\System\fGyantp.exe
  C:\Windows\System\fGyantp.exe
  2⤵
  PID:3564
- C:\Windows\System\ApHTPij.exe
  C:\Windows\System\ApHTPij.exe
  2⤵
  PID:3120
- C:\Windows\System\YswdJGl.exe
  C:\Windows\System\YswdJGl.exe
  2⤵
  PID:4108
- C:\Windows\System\lXGiVeg.exe
  C:\Windows\System\lXGiVeg.exe
  2⤵
  PID:4124
- C:\Windows\System\DGvIfBO.exe
  C:\Windows\System\DGvIfBO.exe
  2⤵
  PID:4140
- C:\Windows\System\DNSWuRP.exe
  C:\Windows\System\DNSWuRP.exe
  2⤵
  PID:4156
- C:\Windows\System\wbHWdiH.exe
  C:\Windows\System\wbHWdiH.exe
  2⤵
  PID:4176
- C:\Windows\System\UJWLOxk.exe
  C:\Windows\System\UJWLOxk.exe
  2⤵
  PID:4192
- C:\Windows\System\GntduXz.exe
  C:\Windows\System\GntduXz.exe
  2⤵
  PID:4208
- C:\Windows\System\GISYonV.exe
  C:\Windows\System\GISYonV.exe
  2⤵
  PID:4224
- C:\Windows\System\heRouuI.exe
  C:\Windows\System\heRouuI.exe
  2⤵
  PID:4244
- C:\Windows\System\yWdgseK.exe
  C:\Windows\System\yWdgseK.exe
  2⤵
  PID:4260
- C:\Windows\System\iWdJQzt.exe
  C:\Windows\System\iWdJQzt.exe
  2⤵
  PID:4276
- C:\Windows\System\lzrmLzn.exe
  C:\Windows\System\lzrmLzn.exe
  2⤵
  PID:4292
- C:\Windows\System\PsQgZmZ.exe
  C:\Windows\System\PsQgZmZ.exe
  2⤵
  PID:4308
- C:\Windows\System\MyfrMCq.exe
  C:\Windows\System\MyfrMCq.exe
  2⤵
  PID:4324
- C:\Windows\System\ugxxPCs.exe
  C:\Windows\System\ugxxPCs.exe
  2⤵
  PID:4340
- C:\Windows\System\TiwjSiu.exe
  C:\Windows\System\TiwjSiu.exe
  2⤵
  PID:4356
- C:\Windows\System\zFpUAuS.exe
  C:\Windows\System\zFpUAuS.exe
  2⤵
  PID:4372
- C:\Windows\System\GKnaEJx.exe
  C:\Windows\System\GKnaEJx.exe
  2⤵
  PID:4388
- C:\Windows\System\FBXLIAF.exe
  C:\Windows\System\FBXLIAF.exe
  2⤵
  PID:4428
- C:\Windows\System\hZlBsVJ.exe
  C:\Windows\System\hZlBsVJ.exe
  2⤵
  PID:4444
- C:\Windows\System\ykBCkgc.exe
  C:\Windows\System\ykBCkgc.exe
  2⤵
  PID:4472
- C:\Windows\System\DPrueFk.exe
  C:\Windows\System\DPrueFk.exe
  2⤵
  PID:4492
- C:\Windows\System\HVEtEhg.exe
  C:\Windows\System\HVEtEhg.exe
  2⤵
  PID:4508
- C:\Windows\System\PVbVrjh.exe
  C:\Windows\System\PVbVrjh.exe
  2⤵
  PID:4524
- C:\Windows\System\JaPAZGY.exe
  C:\Windows\System\JaPAZGY.exe
  2⤵
  PID:4552
- C:\Windows\System\yTJfUde.exe
  C:\Windows\System\yTJfUde.exe
  2⤵
  PID:4568
- C:\Windows\System\ItVktID.exe
  C:\Windows\System\ItVktID.exe
  2⤵
  PID:4592
- C:\Windows\System\foXBXeX.exe
  C:\Windows\System\foXBXeX.exe
  2⤵
  PID:4608
- C:\Windows\System\eNdscVJ.exe
  C:\Windows\System\eNdscVJ.exe
  2⤵
  PID:4624
- C:\Windows\System\YJXnAuT.exe
  C:\Windows\System\YJXnAuT.exe
  2⤵
  PID:4648
- C:\Windows\System\PCECfjW.exe
  C:\Windows\System\PCECfjW.exe
  2⤵
  PID:4672
- C:\Windows\System\pXKSjPq.exe
  C:\Windows\System\pXKSjPq.exe
  2⤵
  PID:4688
- C:\Windows\System\ZCfZotm.exe
  C:\Windows\System\ZCfZotm.exe
  2⤵
  PID:4704
- C:\Windows\System\NtdWbqR.exe
  C:\Windows\System\NtdWbqR.exe
  2⤵
  PID:4720
- C:\Windows\System\YbQfQzJ.exe
  C:\Windows\System\YbQfQzJ.exe
  2⤵
  PID:4736
- C:\Windows\System\bhIOhrO.exe
  C:\Windows\System\bhIOhrO.exe
  2⤵
  PID:4756
- C:\Windows\System\SAVZBEf.exe
  C:\Windows\System\SAVZBEf.exe
  2⤵
  PID:4772
- C:\Windows\System\iPLciUq.exe
  C:\Windows\System\iPLciUq.exe
  2⤵
  PID:4788
- C:\Windows\System\LInLOHx.exe
  C:\Windows\System\LInLOHx.exe
  2⤵
  PID:4804
- C:\Windows\System\IuQYqgd.exe
  C:\Windows\System\IuQYqgd.exe
  2⤵
  PID:4820
- C:\Windows\System\AfhdWXz.exe
  C:\Windows\System\AfhdWXz.exe
  2⤵
  PID:4836
- C:\Windows\System\hVxNNEl.exe
  C:\Windows\System\hVxNNEl.exe
  2⤵
  PID:4852
- C:\Windows\System\BVBBpHh.exe
  C:\Windows\System\BVBBpHh.exe
  2⤵
  PID:4872
- C:\Windows\System\mGUVPxy.exe
  C:\Windows\System\mGUVPxy.exe
  2⤵
  PID:4888
- C:\Windows\System\KrNaLCC.exe
  C:\Windows\System\KrNaLCC.exe
  2⤵
  PID:4904
- C:\Windows\System\rEDHiUV.exe
  C:\Windows\System\rEDHiUV.exe
  2⤵
  PID:4920
- C:\Windows\System\NkTyZmO.exe
  C:\Windows\System\NkTyZmO.exe
  2⤵
  PID:4936
- C:\Windows\System\zLxScIj.exe
  C:\Windows\System\zLxScIj.exe
  2⤵
  PID:4952
- C:\Windows\System\azSVLgu.exe
  C:\Windows\System\azSVLgu.exe
  2⤵
  PID:4968
- C:\Windows\System\zdzMWct.exe
  C:\Windows\System\zdzMWct.exe
  2⤵
  PID:4984
- C:\Windows\System\QVRLOvW.exe
  C:\Windows\System\QVRLOvW.exe
  2⤵
  PID:5000
- C:\Windows\System\TJCuVBZ.exe
  C:\Windows\System\TJCuVBZ.exe
  2⤵
  PID:5016
- C:\Windows\System\kZmsrKx.exe
  C:\Windows\System\kZmsrKx.exe
  2⤵
  PID:5032
- C:\Windows\System\wjGHdFG.exe
  C:\Windows\System\wjGHdFG.exe
  2⤵
  PID:5052
- C:\Windows\System\LEOSqpr.exe
  C:\Windows\System\LEOSqpr.exe
  2⤵
  PID:5068
- C:\Windows\System\FvAedcp.exe
  C:\Windows\System\FvAedcp.exe
  2⤵
  PID:5084
- C:\Windows\System\nsoDgqm.exe
  C:\Windows\System\nsoDgqm.exe
  2⤵
  PID:5100
- C:\Windows\System\AipcTlu.exe
  C:\Windows\System\AipcTlu.exe
  2⤵
  PID:5116
- C:\Windows\System\KSMQEEX.exe
  C:\Windows\System\KSMQEEX.exe
  2⤵
  PID:3132
- C:\Windows\System\bawmVBb.exe
  C:\Windows\System\bawmVBb.exe
  2⤵
  PID:4136
- C:\Windows\System\xrhYyzL.exe
  C:\Windows\System\xrhYyzL.exe
  2⤵
  PID:3900
- C:\Windows\System\eCotcmS.exe
  C:\Windows\System\eCotcmS.exe
  2⤵
  PID:3500
- C:\Windows\System\AJJbmUs.exe
  C:\Windows\System\AJJbmUs.exe
  2⤵
  PID:4120
- C:\Windows\System\cThbHjC.exe
  C:\Windows\System\cThbHjC.exe
  2⤵
  PID:3448
- C:\Windows\System\OuPAggb.exe
  C:\Windows\System\OuPAggb.exe
  2⤵
  PID:4116
- C:\Windows\System\SPPANvI.exe
  C:\Windows\System\SPPANvI.exe
  2⤵
  PID:4220
- C:\Windows\System\noKICuP.exe
  C:\Windows\System\noKICuP.exe
  2⤵
  PID:4300
- C:\Windows\System\xWepALV.exe
  C:\Windows\System\xWepALV.exe
  2⤵
  PID:4284
- C:\Windows\System\luNvFNl.exe
  C:\Windows\System\luNvFNl.exe
  2⤵
  PID:4316
- C:\Windows\System\yMcwDHX.exe
  C:\Windows\System\yMcwDHX.exe
  2⤵
  PID:4408
- C:\Windows\System\MbEpwGQ.exe
  C:\Windows\System\MbEpwGQ.exe
  2⤵
  PID:4364
- C:\Windows\System\PUuTsYP.exe
  C:\Windows\System\PUuTsYP.exe
  2⤵
  PID:4380
- C:\Windows\System\jIoKQjf.exe
  C:\Windows\System\jIoKQjf.exe
  2⤵
  PID:4424
- C:\Windows\System\lrfqFFI.exe
  C:\Windows\System\lrfqFFI.exe
  2⤵
  PID:4468
- C:\Windows\System\qLhhGVj.exe
  C:\Windows\System\qLhhGVj.exe
  2⤵
  PID:4500
- C:\Windows\System\rsSLhmF.exe
  C:\Windows\System\rsSLhmF.exe
  2⤵
  PID:4480
- C:\Windows\System\WqWJuyD.exe
  C:\Windows\System\WqWJuyD.exe
  2⤵
  PID:4536
- C:\Windows\System\CjlCAAu.exe
  C:\Windows\System\CjlCAAu.exe
  2⤵
  PID:4580
- C:\Windows\System\WZOZbsE.exe
  C:\Windows\System\WZOZbsE.exe
  2⤵
  PID:4616
- C:\Windows\System\pPHvDKn.exe
  C:\Windows\System\pPHvDKn.exe
  2⤵
  PID:4632
- C:\Windows\System\SdfQGDh.exe
  C:\Windows\System\SdfQGDh.exe
  2⤵
  PID:4544
- C:\Windows\System\jZCJqBh.exe
  C:\Windows\System\jZCJqBh.exe
  2⤵
  PID:4684
- C:\Windows\System\MvSrLcM.exe
  C:\Windows\System\MvSrLcM.exe
  2⤵
  PID:4732
- C:\Windows\System\WNKUtJP.exe
  C:\Windows\System\WNKUtJP.exe
  2⤵
  PID:4796
- C:\Windows\System\ANgfgPV.exe
  C:\Windows\System\ANgfgPV.exe
  2⤵
  PID:4748
- C:\Windows\System\CIoKKOh.exe
  C:\Windows\System\CIoKKOh.exe
  2⤵
  PID:4832
- C:\Windows\System\TCHMXRk.exe
  C:\Windows\System\TCHMXRk.exe
  2⤵
  PID:4868
- C:\Windows\System\mdMFVIG.exe
  C:\Windows\System\mdMFVIG.exe
  2⤵
  PID:4896
- C:\Windows\System\EANkHvC.exe
  C:\Windows\System\EANkHvC.exe
  2⤵
  PID:4880
- C:\Windows\System\UOJnyPE.exe
  C:\Windows\System\UOJnyPE.exe
  2⤵
  PID:4916
- C:\Windows\System\hosXtcj.exe
  C:\Windows\System\hosXtcj.exe
  2⤵
  PID:4996
- C:\Windows\System\VUJOste.exe
  C:\Windows\System\VUJOste.exe
  2⤵
  PID:4980
- C:\Windows\System\vLnWmam.exe
  C:\Windows\System\vLnWmam.exe
  2⤵
  PID:5028
- C:\Windows\System\emHEyFw.exe
  C:\Windows\System\emHEyFw.exe
  2⤵
  PID:5048
- C:\Windows\System\ILEUDZX.exe
  C:\Windows\System\ILEUDZX.exe
  2⤵
  PID:5076
- C:\Windows\System\HczEDQH.exe
  C:\Windows\System\HczEDQH.exe
  2⤵
  PID:5108
- C:\Windows\System\PsZLOgd.exe
  C:\Windows\System\PsZLOgd.exe
  2⤵
  PID:3936
- C:\Windows\System\cZQfWEd.exe
  C:\Windows\System\cZQfWEd.exe
  2⤵
  PID:3696
- C:\Windows\System\WRZtZQl.exe
  C:\Windows\System\WRZtZQl.exe
  2⤵
  PID:4184
- C:\Windows\System\NRMWtxC.exe
  C:\Windows\System\NRMWtxC.exe
  2⤵
  PID:4288
- C:\Windows\System\BGFILco.exe
  C:\Windows\System\BGFILco.exe
  2⤵
  PID:4368
- C:\Windows\System\owRhAte.exe
  C:\Windows\System\owRhAte.exe
  2⤵
  PID:4396
- C:\Windows\System\rkeCUzC.exe
  C:\Windows\System\rkeCUzC.exe
  2⤵
  PID:4464
- C:\Windows\System\oMYGzbU.exe
  C:\Windows\System\oMYGzbU.exe
  2⤵
  PID:4516
- C:\Windows\System\vfBftiV.exe
  C:\Windows\System\vfBftiV.exe
  2⤵
  PID:4584
- C:\Windows\System\hcYLHzh.exe
  C:\Windows\System\hcYLHzh.exe
  2⤵
  PID:4656
- C:\Windows\System\dgcgPSY.exe
  C:\Windows\System\dgcgPSY.exe
  2⤵
  PID:4668
- C:\Windows\System\njiwBGZ.exe
  C:\Windows\System\njiwBGZ.exe
  2⤵
  PID:4716
- C:\Windows\System\EbXXkRN.exe
  C:\Windows\System\EbXXkRN.exe
  2⤵
  PID:4764
- C:\Windows\System\vgfvdVB.exe
  C:\Windows\System\vgfvdVB.exe
  2⤵
  PID:4660
- C:\Windows\System\RTVKmLM.exe
  C:\Windows\System\RTVKmLM.exe
  2⤵
  PID:4912
- C:\Windows\System\WLVgfYP.exe
  C:\Windows\System\WLVgfYP.exe
  2⤵
  PID:5008
- C:\Windows\System\UwPzYGq.exe
  C:\Windows\System\UwPzYGq.exe
  2⤵
  PID:5064
- C:\Windows\System\KAJlEhF.exe
  C:\Windows\System\KAJlEhF.exe
  2⤵
  PID:4172
- C:\Windows\System\dyaJAot.exe
  C:\Windows\System\dyaJAot.exe
  2⤵
  PID:4204
- C:\Windows\System\FLAKPlK.exe
  C:\Windows\System\FLAKPlK.exe
  2⤵
  PID:4420
- C:\Windows\System\wlnvhcA.exe
  C:\Windows\System\wlnvhcA.exe
  2⤵
  PID:4532
- C:\Windows\System\fujXWfb.exe
  C:\Windows\System\fujXWfb.exe
  2⤵
  PID:4252
- C:\Windows\System\xhszNiX.exe
  C:\Windows\System\xhszNiX.exe
  2⤵
  PID:4440
- C:\Windows\System\AwlNLsE.exe
  C:\Windows\System\AwlNLsE.exe
  2⤵
  PID:4560
- C:\Windows\System\csznbaN.exe
  C:\Windows\System\csznbaN.exe
  2⤵
  PID:4848
- C:\Windows\System\nLFpfKa.exe
  C:\Windows\System\nLFpfKa.exe
  2⤵
  PID:4712
- C:\Windows\System\XPeDNOE.exe
  C:\Windows\System\XPeDNOE.exe
  2⤵
  PID:4784
- C:\Windows\System\MqZyWJf.exe
  C:\Windows\System\MqZyWJf.exe
  2⤵
  PID:4132
- C:\Windows\System\pCfSwGm.exe
  C:\Windows\System\pCfSwGm.exe
  2⤵
  PID:5096
- C:\Windows\System\BKrYyEO.exe
  C:\Windows\System\BKrYyEO.exe
  2⤵
  PID:4460
- C:\Windows\System\uoOdbFf.exe
  C:\Windows\System\uoOdbFf.exe
  2⤵
  PID:280
- C:\Windows\System\zMnblAb.exe
  C:\Windows\System\zMnblAb.exe
  2⤵
  PID:4092
- C:\Windows\System\agpxCQO.exe
  C:\Windows\System\agpxCQO.exe
  2⤵
  PID:5128
- C:\Windows\System\UMBjrOL.exe
  C:\Windows\System\UMBjrOL.exe
  2⤵
  PID:5152
- C:\Windows\System\DONQCfC.exe
  C:\Windows\System\DONQCfC.exe
  2⤵
  PID:5168
- C:\Windows\System\IgoOWQn.exe
  C:\Windows\System\IgoOWQn.exe
  2⤵
  PID:5184
- C:\Windows\System\lgMUBhQ.exe
  C:\Windows\System\lgMUBhQ.exe
  2⤵
  PID:5200
- C:\Windows\System\EeGxyJf.exe
  C:\Windows\System\EeGxyJf.exe
  2⤵
  PID:5216
- C:\Windows\System\DspnqiA.exe
  C:\Windows\System\DspnqiA.exe
  2⤵
  PID:5232
- C:\Windows\System\XbytOZn.exe
  C:\Windows\System\XbytOZn.exe
  2⤵
  PID:5248
- C:\Windows\System\jmgpRFz.exe
  C:\Windows\System\jmgpRFz.exe
  2⤵
  PID:5264
- C:\Windows\System\VczcZsf.exe
  C:\Windows\System\VczcZsf.exe
  2⤵
  PID:5280
- C:\Windows\System\pDIkAXI.exe
  C:\Windows\System\pDIkAXI.exe
  2⤵
  PID:5296
- C:\Windows\System\SpLpToI.exe
  C:\Windows\System\SpLpToI.exe
  2⤵
  PID:5312
- C:\Windows\System\jWnhLnu.exe
  C:\Windows\System\jWnhLnu.exe
  2⤵
  PID:5332
- C:\Windows\System\DmoYxxV.exe
  C:\Windows\System\DmoYxxV.exe
  2⤵
  PID:5352
- C:\Windows\System\DbkyuEH.exe
  C:\Windows\System\DbkyuEH.exe
  2⤵
  PID:5368
- C:\Windows\System\mKheRuW.exe
  C:\Windows\System\mKheRuW.exe
  2⤵
  PID:5384
- C:\Windows\System\HqHJKbJ.exe
  C:\Windows\System\HqHJKbJ.exe
  2⤵
  PID:5400
- C:\Windows\System\BZSYIoy.exe
  C:\Windows\System\BZSYIoy.exe
  2⤵
  PID:5416
- C:\Windows\System\qbuSTBC.exe
  C:\Windows\System\qbuSTBC.exe
  2⤵
  PID:5432
- C:\Windows\System\oVVwFpl.exe
  C:\Windows\System\oVVwFpl.exe
  2⤵
  PID:5448
- C:\Windows\System\iJfcJKH.exe
  C:\Windows\System\iJfcJKH.exe
  2⤵
  PID:5464
- C:\Windows\System\sQBmouf.exe
  C:\Windows\System\sQBmouf.exe
  2⤵
  PID:5480
- C:\Windows\System\pQdAWgo.exe
  C:\Windows\System\pQdAWgo.exe
  2⤵
  PID:5504
- C:\Windows\System\NTtEYNW.exe
  C:\Windows\System\NTtEYNW.exe
  2⤵
  PID:5524
- C:\Windows\System\RKZpYKf.exe
  C:\Windows\System\RKZpYKf.exe
  2⤵
  PID:5540
- C:\Windows\System\UCamUMT.exe
  C:\Windows\System\UCamUMT.exe
  2⤵
  PID:5556
- C:\Windows\System\leSdzIN.exe
  C:\Windows\System\leSdzIN.exe
  2⤵
  PID:5572
- C:\Windows\System\AAZwIam.exe
  C:\Windows\System\AAZwIam.exe
  2⤵
  PID:5592
- C:\Windows\System\ITyPgva.exe
  C:\Windows\System\ITyPgva.exe
  2⤵
  PID:5612
- C:\Windows\System\DakwWMY.exe
  C:\Windows\System\DakwWMY.exe
  2⤵
  PID:5628
- C:\Windows\System\ThWeCxt.exe
  C:\Windows\System\ThWeCxt.exe
  2⤵
  PID:5644
- C:\Windows\System\ksbpHOb.exe
  C:\Windows\System\ksbpHOb.exe
  2⤵
  PID:5660
- C:\Windows\System\BuiqLqA.exe
  C:\Windows\System\BuiqLqA.exe
  2⤵
  PID:5676
- C:\Windows\System\pGRZkYo.exe
  C:\Windows\System\pGRZkYo.exe
  2⤵
  PID:5692
- C:\Windows\System\ceiDcOj.exe
  C:\Windows\System\ceiDcOj.exe
  2⤵
  PID:5708
- C:\Windows\System\hlDIUhr.exe
  C:\Windows\System\hlDIUhr.exe
  2⤵
  PID:5724
- C:\Windows\System\enyXuQH.exe
  C:\Windows\System\enyXuQH.exe
  2⤵
  PID:5740
- C:\Windows\System\tXjhHJr.exe
  C:\Windows\System\tXjhHJr.exe
  2⤵
  PID:5756
- C:\Windows\System\NiWfZJn.exe
  C:\Windows\System\NiWfZJn.exe
  2⤵
  PID:5772
- C:\Windows\System\fsEsBnt.exe
  C:\Windows\System\fsEsBnt.exe
  2⤵
  PID:5788
- C:\Windows\System\TAeYAoy.exe
  C:\Windows\System\TAeYAoy.exe
  2⤵
  PID:5804
- C:\Windows\System\iEpWJQt.exe
  C:\Windows\System\iEpWJQt.exe
  2⤵
  PID:5820
- C:\Windows\System\stEfiPC.exe
  C:\Windows\System\stEfiPC.exe
  2⤵
  PID:5836
- C:\Windows\System\VsCZKJQ.exe
  C:\Windows\System\VsCZKJQ.exe
  2⤵
  PID:5852
- C:\Windows\System\JxIASZm.exe
  C:\Windows\System\JxIASZm.exe
  2⤵
  PID:5868
- C:\Windows\System\lKYYhEP.exe
  C:\Windows\System\lKYYhEP.exe
  2⤵
  PID:5884
- C:\Windows\System\TPEJfGd.exe
  C:\Windows\System\TPEJfGd.exe
  2⤵
  PID:5900
- C:\Windows\System\JNGpwVR.exe
  C:\Windows\System\JNGpwVR.exe
  2⤵
  PID:5924
- C:\Windows\System\jtTXQQv.exe
  C:\Windows\System\jtTXQQv.exe
  2⤵
  PID:5944
- C:\Windows\System\vZpvZlS.exe
  C:\Windows\System\vZpvZlS.exe
  2⤵
  PID:5960
- C:\Windows\System\clIHzIB.exe
  C:\Windows\System\clIHzIB.exe
  2⤵
  PID:5976
- C:\Windows\System\kKVvJQq.exe
  C:\Windows\System\kKVvJQq.exe
  2⤵
  PID:5996
- C:\Windows\System\HNQidMy.exe
  C:\Windows\System\HNQidMy.exe
  2⤵
  PID:6012
- C:\Windows\System\dXUaVaj.exe
  C:\Windows\System\dXUaVaj.exe
  2⤵
  PID:6028
- C:\Windows\System\RTZfeWT.exe
  C:\Windows\System\RTZfeWT.exe
  2⤵
  PID:6052
- C:\Windows\System\WkacTsU.exe
  C:\Windows\System\WkacTsU.exe
  2⤵
  PID:6072
- C:\Windows\System\hpIJddw.exe
  C:\Windows\System\hpIJddw.exe
  2⤵
  PID:6088
- C:\Windows\System\XpTQGGu.exe
  C:\Windows\System\XpTQGGu.exe
  2⤵
  PID:6108
- C:\Windows\System\SGVcDoT.exe
  C:\Windows\System\SGVcDoT.exe
  2⤵
  PID:6124
- C:\Windows\System\muwIKcL.exe
  C:\Windows\System\muwIKcL.exe
  2⤵
  PID:5228
- C:\Windows\System\doOvDdq.exe
  C:\Windows\System\doOvDdq.exe
  2⤵
  PID:5320
- C:\Windows\System\oWaKEwp.exe
  C:\Windows\System\oWaKEwp.exe
  2⤵
  PID:5532
- C:\Windows\System\dtpEkRP.exe
  C:\Windows\System\dtpEkRP.exe
  2⤵
  PID:5600
- C:\Windows\System\VfmygiW.exe
  C:\Windows\System\VfmygiW.exe
  2⤵
  PID:5636
- C:\Windows\System\HixjzXO.exe
  C:\Windows\System\HixjzXO.exe
  2⤵
  PID:5668
- C:\Windows\System\ftZwFjf.exe
  C:\Windows\System\ftZwFjf.exe
  2⤵
  PID:5920
- C:\Windows\System\vqVvDdQ.exe
  C:\Windows\System\vqVvDdQ.exe
  2⤵
  PID:6004
- C:\Windows\System\AXAQLrp.exe
  C:\Windows\System\AXAQLrp.exe
  2⤵
  PID:6040
- C:\Windows\System\YsHZbNO.exe
  C:\Windows\System\YsHZbNO.exe
  2⤵
  PID:5992
- C:\Windows\System\gXwJRpW.exe
  C:\Windows\System\gXwJRpW.exe
  2⤵
  PID:6064
- C:\Windows\System\jlQreCB.exe
  C:\Windows\System\jlQreCB.exe
  2⤵
  PID:6104
- C:\Windows\System\iwWPFHx.exe
  C:\Windows\System\iwWPFHx.exe
  2⤵
  PID:5324
- C:\Windows\System\MpfCJnW.exe
  C:\Windows\System\MpfCJnW.exe
  2⤵
  PID:6140
- C:\Windows\System\PfxFwYd.exe
  C:\Windows\System\PfxFwYd.exe
  2⤵
  PID:5196
- C:\Windows\System\wOMOMWP.exe
  C:\Windows\System\wOMOMWP.exe
  2⤵
  PID:5308
- C:\Windows\System\rSvVPZD.exe
  C:\Windows\System\rSvVPZD.exe
  2⤵
  PID:5212
- C:\Windows\System\AiROeVE.exe
  C:\Windows\System\AiROeVE.exe
  2⤵
  PID:5440
- C:\Windows\System\UcHuoEG.exe
  C:\Windows\System\UcHuoEG.exe
  2⤵
  PID:5428
- C:\Windows\System\ZpdpdKD.exe
  C:\Windows\System\ZpdpdKD.exe
  2⤵
  PID:5376
- C:\Windows\System\mwrVgvM.exe
  C:\Windows\System\mwrVgvM.exe
  2⤵
  PID:5340
- C:\Windows\System\sYZzCtq.exe
  C:\Windows\System\sYZzCtq.exe
  2⤵
  PID:5272
- C:\Windows\System\IiaaQpK.exe
  C:\Windows\System\IiaaQpK.exe
  2⤵
  PID:5496
- C:\Windows\System\LdhqVOy.exe
  C:\Windows\System\LdhqVOy.exe
  2⤵
  PID:5568
- C:\Windows\System\LSjmTXb.exe
  C:\Windows\System\LSjmTXb.exe
  2⤵
  PID:6080
- C:\Windows\System\fwGYCiA.exe
  C:\Windows\System\fwGYCiA.exe
  2⤵
  PID:6100
- C:\Windows\System\NHWpbwz.exe
  C:\Windows\System\NHWpbwz.exe
  2⤵
  PID:5040
- C:\Windows\System\PjdeXts.exe
  C:\Windows\System\PjdeXts.exe
  2⤵
  PID:5876
- C:\Windows\System\fUGPMcv.exe
  C:\Windows\System\fUGPMcv.exe
  2⤵
  PID:5940
- C:\Windows\System\MRgLEtw.exe
  C:\Windows\System\MRgLEtw.exe
  2⤵
  PID:5608
- C:\Windows\System\RCqhdzB.exe
  C:\Windows\System\RCqhdzB.exe
  2⤵
  PID:5516
- C:\Windows\System\wqpyuOx.exe
  C:\Windows\System\wqpyuOx.exe
  2⤵
  PID:6036
- C:\Windows\System\BtHlwzS.exe
  C:\Windows\System\BtHlwzS.exe
  2⤵
  PID:6132
- C:\Windows\System\PWAZEFL.exe
  C:\Windows\System\PWAZEFL.exe
  2⤵
  PID:5796
- C:\Windows\System\jFhkfUV.exe
  C:\Windows\System\jFhkfUV.exe
  2⤵
  PID:5864
- C:\Windows\System\fvWLwBC.exe
  C:\Windows\System\fvWLwBC.exe
  2⤵
  PID:5828
- C:\Windows\System\MfXygMB.exe
  C:\Windows\System\MfXygMB.exe
  2⤵
  PID:5260
- C:\Windows\System\lBdDMaT.exe
  C:\Windows\System\lBdDMaT.exe
  2⤵
  PID:5328
- C:\Windows\System\GYJpBbo.exe
  C:\Windows\System\GYJpBbo.exe
  2⤵
  PID:5548
- C:\Windows\System\khsYYFQ.exe
  C:\Windows\System\khsYYFQ.exe
  2⤵
  PID:5580
- C:\Windows\System\RuorngD.exe
  C:\Windows\System\RuorngD.exe
  2⤵
  PID:5688
- C:\Windows\System\fnftPRY.exe
  C:\Windows\System\fnftPRY.exe
  2⤵
  PID:5816
- C:\Windows\System\hlFBYXT.exe
  C:\Windows\System\hlFBYXT.exe
  2⤵
  PID:5656
- C:\Windows\System\AXoBBaE.exe
  C:\Windows\System\AXoBBaE.exe
  2⤵
  PID:4404
- C:\Windows\System\aTYWRXk.exe
  C:\Windows\System\aTYWRXk.exe
  2⤵
  PID:5956
- C:\Windows\System\hNKytNT.exe
  C:\Windows\System\hNKytNT.exe
  2⤵
  PID:5784
- C:\Windows\System\EcQcqcm.exe
  C:\Windows\System\EcQcqcm.exe
  2⤵
  PID:5500
- C:\Windows\System\OVAhqAe.exe
  C:\Windows\System\OVAhqAe.exe
  2⤵
  PID:5292
- C:\Windows\System\UitQGLz.exe
  C:\Windows\System\UitQGLz.exe
  2⤵
  PID:5732
- C:\Windows\System\xNSUBJd.exe
  C:\Windows\System\xNSUBJd.exe
  2⤵
  PID:5896
- C:\Windows\System\rLFnGzn.exe
  C:\Windows\System\rLFnGzn.exe
  2⤵
  PID:5620
- C:\Windows\System\WUiRbMH.exe
  C:\Windows\System\WUiRbMH.exe
  2⤵
  PID:5916
- C:\Windows\System\WDiOumm.exe
  C:\Windows\System\WDiOumm.exe
  2⤵
  PID:5716
- C:\Windows\System\eTAxIvz.exe
  C:\Windows\System\eTAxIvz.exe
  2⤵
  PID:5348
- C:\Windows\System\ZhjnVHT.exe
  C:\Windows\System\ZhjnVHT.exe
  2⤵
  PID:5908
- C:\Windows\System\jblYDCc.exe
  C:\Windows\System\jblYDCc.exe
  2⤵
  PID:5720
- C:\Windows\System\TRfpJaO.exe
  C:\Windows\System\TRfpJaO.exe
  2⤵
  PID:5408
- C:\Windows\System\KvdYhAh.exe
  C:\Windows\System\KvdYhAh.exe
  2⤵
  PID:5208
- C:\Windows\System\yTdpUOg.exe
  C:\Windows\System\yTdpUOg.exe
  2⤵
  PID:5472
- C:\Windows\System\mycjbIT.exe
  C:\Windows\System\mycjbIT.exe
  2⤵
  PID:5588
- C:\Windows\System\ciUPvUj.exe
  C:\Windows\System\ciUPvUj.exe
  2⤵
  PID:5176
- C:\Windows\System\smwgDeY.exe
  C:\Windows\System\smwgDeY.exe
  2⤵
  PID:6156
- C:\Windows\System\locNtln.exe
  C:\Windows\System\locNtln.exe
  2⤵
  PID:6172
- C:\Windows\System\VXrKfAk.exe
  C:\Windows\System\VXrKfAk.exe
  2⤵
  PID:6188
- C:\Windows\System\xfJXZWn.exe
  C:\Windows\System\xfJXZWn.exe
  2⤵
  PID:6204
- C:\Windows\System\pQNYMKp.exe
  C:\Windows\System\pQNYMKp.exe
  2⤵
  PID:6220
- C:\Windows\System\BPBTLoF.exe
  C:\Windows\System\BPBTLoF.exe
  2⤵
  PID:6236
- C:\Windows\System\VtievYX.exe
  C:\Windows\System\VtievYX.exe
  2⤵
  PID:6252
- C:\Windows\System\vdUVYgX.exe
  C:\Windows\System\vdUVYgX.exe
  2⤵
  PID:6284
- C:\Windows\System\JNPHbEx.exe
  C:\Windows\System\JNPHbEx.exe
  2⤵
  PID:6300
- C:\Windows\System\jbgfujT.exe
  C:\Windows\System\jbgfujT.exe
  2⤵
  PID:6320
- C:\Windows\System\REAylEX.exe
  C:\Windows\System\REAylEX.exe
  2⤵
  PID:6336
- C:\Windows\System\dbadLFz.exe
  C:\Windows\System\dbadLFz.exe
  2⤵
  PID:6352
- C:\Windows\System\SzmpWaW.exe
  C:\Windows\System\SzmpWaW.exe
  2⤵
  PID:6368
- C:\Windows\System\snnVKUv.exe
  C:\Windows\System\snnVKUv.exe
  2⤵
  PID:6384
- C:\Windows\System\cTaQyUO.exe
  C:\Windows\System\cTaQyUO.exe
  2⤵
  PID:6400
- C:\Windows\System\cgSBlWp.exe
  C:\Windows\System\cgSBlWp.exe
  2⤵
  PID:6416
- C:\Windows\System\CMsxYXu.exe
  C:\Windows\System\CMsxYXu.exe
  2⤵
  PID:6432
- C:\Windows\System\KJlXecg.exe
  C:\Windows\System\KJlXecg.exe
  2⤵
  PID:6452
- C:\Windows\System\xXsskmc.exe
  C:\Windows\System\xXsskmc.exe
  2⤵
  PID:6468
- C:\Windows\System\cBdmHIG.exe
  C:\Windows\System\cBdmHIG.exe
  2⤵
  PID:6484
- C:\Windows\System\wnrmhAU.exe
  C:\Windows\System\wnrmhAU.exe
  2⤵
  PID:6500
- C:\Windows\System\HsGEovJ.exe
  C:\Windows\System\HsGEovJ.exe
  2⤵
  PID:6516
- C:\Windows\System\JEISWIS.exe
  C:\Windows\System\JEISWIS.exe
  2⤵
  PID:6540
- C:\Windows\System\JhuYsNk.exe
  C:\Windows\System\JhuYsNk.exe
  2⤵
  PID:6556
- C:\Windows\System\ueqMBuq.exe
  C:\Windows\System\ueqMBuq.exe
  2⤵
  PID:6572
- C:\Windows\System\JXDhcJz.exe
  C:\Windows\System\JXDhcJz.exe
  2⤵
  PID:6588
- C:\Windows\System\zTQFvgo.exe
  C:\Windows\System\zTQFvgo.exe
  2⤵
  PID:6604
- C:\Windows\System\UbqxJYi.exe
  C:\Windows\System\UbqxJYi.exe
  2⤵
  PID:6620
- C:\Windows\System\zCJIeme.exe
  C:\Windows\System\zCJIeme.exe
  2⤵
  PID:6636
- C:\Windows\System\ioLUcKO.exe
  C:\Windows\System\ioLUcKO.exe
  2⤵
  PID:6652
- C:\Windows\System\umraQBo.exe
  C:\Windows\System\umraQBo.exe
  2⤵
  PID:6668
- C:\Windows\System\UQHZBjn.exe
  C:\Windows\System\UQHZBjn.exe
  2⤵
  PID:6688
- C:\Windows\System\HZEPGdy.exe
  C:\Windows\System\HZEPGdy.exe
  2⤵
  PID:6704
- C:\Windows\System\fTzvGJk.exe
  C:\Windows\System\fTzvGJk.exe
  2⤵
  PID:6724
- C:\Windows\System\aJgrqbM.exe
  C:\Windows\System\aJgrqbM.exe
  2⤵
  PID:6744
- C:\Windows\System\LGnHyNm.exe
  C:\Windows\System\LGnHyNm.exe
  2⤵
  PID:6760
- C:\Windows\System\ifPxVYn.exe
  C:\Windows\System\ifPxVYn.exe
  2⤵
  PID:6776
- C:\Windows\System\GaeEdcx.exe
  C:\Windows\System\GaeEdcx.exe
  2⤵
  PID:6792
- C:\Windows\System\guFFhjM.exe
  C:\Windows\System\guFFhjM.exe
  2⤵
  PID:6808
- C:\Windows\System\bQYjLeq.exe
  C:\Windows\System\bQYjLeq.exe
  2⤵
  PID:6824
- C:\Windows\System\BMqSjpf.exe
  C:\Windows\System\BMqSjpf.exe
  2⤵
  PID:6840
- C:\Windows\System\FuzqKxE.exe
  C:\Windows\System\FuzqKxE.exe
  2⤵
  PID:6860
- C:\Windows\System\kLxJYsO.exe
  C:\Windows\System\kLxJYsO.exe
  2⤵
  PID:6880
- C:\Windows\System\HUUgpVL.exe
  C:\Windows\System\HUUgpVL.exe
  2⤵
  PID:6896
- C:\Windows\System\fdAzgeb.exe
  C:\Windows\System\fdAzgeb.exe
  2⤵
  PID:6912
- C:\Windows\System\VyUlVZJ.exe
  C:\Windows\System\VyUlVZJ.exe
  2⤵
  PID:6928
- C:\Windows\System\zWBRNhl.exe
  C:\Windows\System\zWBRNhl.exe
  2⤵
  PID:6948
- C:\Windows\System\IksPpUJ.exe
  C:\Windows\System\IksPpUJ.exe
  2⤵
  PID:6964
- C:\Windows\System\zHQhyAZ.exe
  C:\Windows\System\zHQhyAZ.exe
  2⤵
  PID:6980
- C:\Windows\System\bZduCzy.exe
  C:\Windows\System\bZduCzy.exe
  2⤵
  PID:6996
- C:\Windows\System\bLnrjeM.exe
  C:\Windows\System\bLnrjeM.exe
  2⤵
  PID:7012
- C:\Windows\System\ERGECbm.exe
  C:\Windows\System\ERGECbm.exe
  2⤵
  PID:7028
- C:\Windows\System\doAYOCC.exe
  C:\Windows\System\doAYOCC.exe
  2⤵
  PID:7044
- C:\Windows\System\UTGLNyB.exe
  C:\Windows\System\UTGLNyB.exe
  2⤵
  PID:7060
- C:\Windows\System\aFCmulh.exe
  C:\Windows\System\aFCmulh.exe
  2⤵
  PID:7076
- C:\Windows\System\vnnrIAt.exe
  C:\Windows\System\vnnrIAt.exe
  2⤵
  PID:7092
- C:\Windows\System\DOHkGOj.exe
  C:\Windows\System\DOHkGOj.exe
  2⤵
  PID:7108
- C:\Windows\System\knsdMtM.exe
  C:\Windows\System\knsdMtM.exe
  2⤵
  PID:7124
- C:\Windows\System\IcrNQEF.exe
  C:\Windows\System\IcrNQEF.exe
  2⤵
  PID:7144
- C:\Windows\System\spUiMCa.exe
  C:\Windows\System\spUiMCa.exe
  2⤵
  PID:7160
- C:\Windows\System\TouufEP.exe
  C:\Windows\System\TouufEP.exe
  2⤵
  PID:6180
- C:\Windows\System\WxLIVOk.exe
  C:\Windows\System\WxLIVOk.exe
  2⤵
  PID:5392
- C:\Windows\System\YCdObSb.exe
  C:\Windows\System\YCdObSb.exe
  2⤵
  PID:5488
- C:\Windows\System\cvVVRig.exe
  C:\Windows\System\cvVVRig.exe
  2⤵
  PID:5832
- C:\Windows\System\ggJhrKz.exe
  C:\Windows\System\ggJhrKz.exe
  2⤵
  PID:6200
- C:\Windows\System\Lnjvziw.exe
  C:\Windows\System\Lnjvziw.exe
  2⤵
  PID:5276
- C:\Windows\System\nLqDbEM.exe
  C:\Windows\System\nLqDbEM.exe
  2⤵
  PID:6264
- C:\Windows\System\dRkkjKH.exe
  C:\Windows\System\dRkkjKH.exe
  2⤵
  PID:6476
- C:\Windows\System\rDkdtnZ.exe
  C:\Windows\System\rDkdtnZ.exe
  2⤵
  PID:6532
- C:\Windows\System\Sgshkws.exe
  C:\Windows\System\Sgshkws.exe
  2⤵
  PID:6568
- C:\Windows\System\OTqFeVG.exe
  C:\Windows\System\OTqFeVG.exe
  2⤵
  PID:6600
- C:\Windows\System\vqrDlbu.exe
  C:\Windows\System\vqrDlbu.exe
  2⤵
  PID:6684
- C:\Windows\System\ddzAyYc.exe
  C:\Windows\System\ddzAyYc.exe
  2⤵
  PID:6664
- C:\Windows\System\AaJfCaL.exe
  C:\Windows\System\AaJfCaL.exe
  2⤵
  PID:6644
- C:\Windows\System\qikVpvp.exe
  C:\Windows\System\qikVpvp.exe
  2⤵
  PID:6628
- C:\Windows\System\zLCKDOq.exe
  C:\Windows\System\zLCKDOq.exe
  2⤵
  PID:6736
- C:\Windows\System\UsWxZkJ.exe
  C:\Windows\System\UsWxZkJ.exe
  2⤵
  PID:6772
- C:\Windows\System\PdxwUVC.exe
  C:\Windows\System\PdxwUVC.exe
  2⤵
  PID:6752
- C:\Windows\System\eWJbtdj.exe
  C:\Windows\System\eWJbtdj.exe
  2⤵
  PID:6872
- C:\Windows\System\lPHGKOH.exe
  C:\Windows\System\lPHGKOH.exe
  2⤵
  PID:6784
- C:\Windows\System\JMjGjBl.exe
  C:\Windows\System\JMjGjBl.exe
  2⤵
  PID:6848
- C:\Windows\System\hBIKANC.exe
  C:\Windows\System\hBIKANC.exe
  2⤵
  PID:6976
- C:\Windows\System\ujnySmf.exe
  C:\Windows\System\ujnySmf.exe
  2⤵
  PID:6960
- C:\Windows\System\CfQKqFZ.exe
  C:\Windows\System\CfQKqFZ.exe
  2⤵
  PID:7068
- C:\Windows\System\rsBNObr.exe
  C:\Windows\System\rsBNObr.exe
  2⤵
  PID:7132
- C:\Windows\System\ZwdZlfG.exe
  C:\Windows\System\ZwdZlfG.exe
  2⤵
  PID:7104
- C:\Windows\System\KTREDHu.exe
  C:\Windows\System\KTREDHu.exe
  2⤵
  PID:7156
- C:\Windows\System\IQBaSbh.exe
  C:\Windows\System\IQBaSbh.exe
  2⤵
  PID:5968
- C:\Windows\System\eZEljCi.exe
  C:\Windows\System\eZEljCi.exe
  2⤵
  PID:6260
- C:\Windows\System\aBGZyjs.exe
  C:\Windows\System\aBGZyjs.exe
  2⤵
  PID:6248
- C:\Windows\System\KLMzLbw.exe
  C:\Windows\System\KLMzLbw.exe
  2⤵
  PID:6280
- C:\Windows\System\Jysembk.exe
  C:\Windows\System\Jysembk.exe
  2⤵
  PID:6296
- C:\Windows\System\eisEaPv.exe
  C:\Windows\System\eisEaPv.exe
  2⤵
  PID:6428
- C:\Windows\System\eYAqxIm.exe
  C:\Windows\System\eYAqxIm.exe
  2⤵
  PID:6460
- C:\Windows\System\TmfnHnU.exe
  C:\Windows\System\TmfnHnU.exe
  2⤵
  PID:6380
- C:\Windows\System\UepDfOB.exe
  C:\Windows\System\UepDfOB.exe
  2⤵
  PID:6444
- C:\Windows\System\PlzhBso.exe
  C:\Windows\System\PlzhBso.exe
  2⤵
  PID:6564
- C:\Windows\System\KgPKtqe.exe
  C:\Windows\System\KgPKtqe.exe
  2⤵
  PID:6680
- C:\Windows\System\rzbsHGM.exe
  C:\Windows\System\rzbsHGM.exe
  2⤵
  PID:6524
- C:\Windows\System\BwxGEfv.exe
  C:\Windows\System\BwxGEfv.exe
  2⤵
  PID:6632
- C:\Windows\System\AQWWDPZ.exe
  C:\Windows\System\AQWWDPZ.exe
  2⤵
  PID:5768
- C:\Windows\System\ESzfIpG.exe
  C:\Windows\System\ESzfIpG.exe
  2⤵
  PID:6856
- C:\Windows\System\yyVNeva.exe
  C:\Windows\System\yyVNeva.exe
  2⤵
  PID:6908
- C:\Windows\System\RAlHHCg.exe
  C:\Windows\System\RAlHHCg.exe
  2⤵
  PID:6892
- C:\Windows\System\fopyiem.exe
  C:\Windows\System\fopyiem.exe
  2⤵
  PID:6244
- C:\Windows\System\ZRfxJxM.exe
  C:\Windows\System\ZRfxJxM.exe
  2⤵
  PID:6408
- C:\Windows\System\zQbOGbb.exe
  C:\Windows\System\zQbOGbb.exe
  2⤵
  PID:6712
- C:\Windows\System\VutjCZQ.exe
  C:\Windows\System\VutjCZQ.exe
  2⤵
  PID:7152
- C:\Windows\System\BBCJukI.exe
  C:\Windows\System\BBCJukI.exe
  2⤵
  PID:7020
- C:\Windows\System\LmOIsUa.exe
  C:\Windows\System\LmOIsUa.exe
  2⤵
  PID:6920
- C:\Windows\System\YhXPPXa.exe
  C:\Windows\System\YhXPPXa.exe
  2⤵
  PID:7136
- C:\Windows\System\NMdArCs.exe
  C:\Windows\System\NMdArCs.exe
  2⤵
  PID:6272
- C:\Windows\System\XpUSOSv.exe
  C:\Windows\System\XpUSOSv.exe
  2⤵
  PID:6316
- C:\Windows\System\fPVrFwz.exe
  C:\Windows\System\fPVrFwz.exe
  2⤵
  PID:6508
- C:\Windows\System\bhXZtlw.exe
  C:\Windows\System\bhXZtlw.exe
  2⤵
  PID:6716
- C:\Windows\System\tYFiwah.exe
  C:\Windows\System\tYFiwah.exe
  2⤵
  PID:7088
- C:\Windows\System\vKGHTPu.exe
  C:\Windows\System\vKGHTPu.exe
  2⤵
  PID:6292
- C:\Windows\System\sefSsid.exe
  C:\Windows\System\sefSsid.exe
  2⤵
  PID:6148
- C:\Windows\System\bzIZkEX.exe
  C:\Windows\System\bzIZkEX.exe
  2⤵
  PID:6956
- C:\Windows\System\bpIvIui.exe
  C:\Windows\System\bpIvIui.exe
  2⤵
  PID:6344
- C:\Windows\System\xFJsLrg.exe
  C:\Windows\System\xFJsLrg.exe
  2⤵
  PID:6552
- C:\Windows\System\AJWNCoJ.exe
  C:\Windows\System\AJWNCoJ.exe
  2⤵
  PID:6212
- C:\Windows\System\xjoRWzI.exe
  C:\Windows\System\xjoRWzI.exe
  2⤵
  PID:7116
- C:\Windows\System\CWrATkz.exe
  C:\Windows\System\CWrATkz.exe
  2⤵
  PID:6836
- C:\Windows\System\oLUPGNz.exe
  C:\Windows\System\oLUPGNz.exe
  2⤵
  PID:6924
- C:\Windows\System\dusmzTl.exe
  C:\Windows\System\dusmzTl.exe
  2⤵
  PID:6392
- C:\Windows\System\vCoKHZP.exe
  C:\Windows\System\vCoKHZP.exe
  2⤵
  PID:6496
- C:\Windows\System\QzPjUwi.exe
  C:\Windows\System\QzPjUwi.exe
  2⤵
  PID:7036
- C:\Windows\System\ZbBcztr.exe
  C:\Windows\System\ZbBcztr.exe
  2⤵
  PID:6944
- C:\Windows\System\mjQrAuc.exe
  C:\Windows\System\mjQrAuc.exe
  2⤵
  PID:6988
- C:\Windows\System\kqRHxAZ.exe
  C:\Windows\System\kqRHxAZ.exe
  2⤵
  PID:6768
- C:\Windows\System\DMyiFFo.exe
  C:\Windows\System\DMyiFFo.exe
  2⤵
  PID:7180
- C:\Windows\System\URzBwwk.exe
  C:\Windows\System\URzBwwk.exe
  2⤵
  PID:7196
- C:\Windows\System\mrzWeqA.exe
  C:\Windows\System\mrzWeqA.exe
  2⤵
  PID:7212
- C:\Windows\System\VVQtcpW.exe
  C:\Windows\System\VVQtcpW.exe
  2⤵
  PID:7228
- C:\Windows\System\TZudrHH.exe
  C:\Windows\System\TZudrHH.exe
  2⤵
  PID:7244
- C:\Windows\System\taZTsLY.exe
  C:\Windows\System\taZTsLY.exe
  2⤵
  PID:7264
- C:\Windows\System\vFkhJsH.exe
  C:\Windows\System\vFkhJsH.exe
  2⤵
  PID:7280
- C:\Windows\System\zGLzNrU.exe
  C:\Windows\System\zGLzNrU.exe
  2⤵
  PID:7296
- C:\Windows\System\SncaVVM.exe
  C:\Windows\System\SncaVVM.exe
  2⤵
  PID:7316
- C:\Windows\System\Aclwbvp.exe
  C:\Windows\System\Aclwbvp.exe
  2⤵
  PID:7332
- C:\Windows\System\pRDckOf.exe
  C:\Windows\System\pRDckOf.exe
  2⤵
  PID:7348
- C:\Windows\System\xRTDjoc.exe
  C:\Windows\System\xRTDjoc.exe
  2⤵
  PID:7364
- C:\Windows\System\isbDYeo.exe
  C:\Windows\System\isbDYeo.exe
  2⤵
  PID:7380
- C:\Windows\System\VdAwAeJ.exe
  C:\Windows\System\VdAwAeJ.exe
  2⤵
  PID:7396
- C:\Windows\System\mJEUFuJ.exe
  C:\Windows\System\mJEUFuJ.exe
  2⤵
  PID:7412
- C:\Windows\System\BZbspPo.exe
  C:\Windows\System\BZbspPo.exe
  2⤵
  PID:7428
- C:\Windows\System\ijCKkOR.exe
  C:\Windows\System\ijCKkOR.exe
  2⤵
  PID:7444
- C:\Windows\System\lnLEEDf.exe
  C:\Windows\System\lnLEEDf.exe
  2⤵
  PID:7460
- C:\Windows\System\vBkObDl.exe
  C:\Windows\System\vBkObDl.exe
  2⤵
  PID:7476
- C:\Windows\System\IvwICKK.exe
  C:\Windows\System\IvwICKK.exe
  2⤵
  PID:7492
- C:\Windows\System\lmUEUyR.exe
  C:\Windows\System\lmUEUyR.exe
  2⤵
  PID:7508
- C:\Windows\System\ephxQYX.exe
  C:\Windows\System\ephxQYX.exe
  2⤵
  PID:7524
- C:\Windows\System\RjLfYMJ.exe
  C:\Windows\System\RjLfYMJ.exe
  2⤵
  PID:7540
- C:\Windows\System\oJEKoCC.exe
  C:\Windows\System\oJEKoCC.exe
  2⤵
  PID:7556
- C:\Windows\System\MJgVitf.exe
  C:\Windows\System\MJgVitf.exe
  2⤵
  PID:7572
- C:\Windows\System\QBoMvca.exe
  C:\Windows\System\QBoMvca.exe
  2⤵
  PID:7588
- C:\Windows\System\AKqwnUp.exe
  C:\Windows\System\AKqwnUp.exe
  2⤵
  PID:7604
- C:\Windows\System\VmFymwM.exe
  C:\Windows\System\VmFymwM.exe
  2⤵
  PID:7620
- C:\Windows\System\DbDdPit.exe
  C:\Windows\System\DbDdPit.exe
  2⤵
  PID:7636
- C:\Windows\System\JirFqWB.exe
  C:\Windows\System\JirFqWB.exe
  2⤵
  PID:7652
- C:\Windows\System\ynVfTJx.exe
  C:\Windows\System\ynVfTJx.exe
  2⤵
  PID:7668
- C:\Windows\System\IjapFQP.exe
  C:\Windows\System\IjapFQP.exe
  2⤵
  PID:7684
- C:\Windows\System\NLJANnz.exe
  C:\Windows\System\NLJANnz.exe
  2⤵
  PID:7700
- C:\Windows\System\UWleyjI.exe
  C:\Windows\System\UWleyjI.exe
  2⤵
  PID:7716
- C:\Windows\System\msMZVju.exe
  C:\Windows\System\msMZVju.exe
  2⤵
  PID:7732
- C:\Windows\System\xuEetag.exe
  C:\Windows\System\xuEetag.exe
  2⤵
  PID:7748
- C:\Windows\System\GjWToeQ.exe
  C:\Windows\System\GjWToeQ.exe
  2⤵
  PID:7764
- C:\Windows\System\WZCIgiS.exe
  C:\Windows\System\WZCIgiS.exe
  2⤵
  PID:7780
- C:\Windows\System\mRoKswk.exe
  C:\Windows\System\mRoKswk.exe
  2⤵
  PID:7796
- C:\Windows\System\ZTRCpPV.exe
  C:\Windows\System\ZTRCpPV.exe
  2⤵
  PID:7812
- C:\Windows\System\huwfRko.exe
  C:\Windows\System\huwfRko.exe
  2⤵
  PID:7828
- C:\Windows\System\MJXyyTf.exe
  C:\Windows\System\MJXyyTf.exe
  2⤵
  PID:7844
- C:\Windows\System\lEZrArM.exe
  C:\Windows\System\lEZrArM.exe
  2⤵
  PID:7860
- C:\Windows\System\CAYqVUz.exe
  C:\Windows\System\CAYqVUz.exe
  2⤵
  PID:7876
- C:\Windows\System\BjRhtEu.exe
  C:\Windows\System\BjRhtEu.exe
  2⤵
  PID:7892
- C:\Windows\System\EsbJlvF.exe
  C:\Windows\System\EsbJlvF.exe
  2⤵
  PID:7908
- C:\Windows\System\dCydXkI.exe
  C:\Windows\System\dCydXkI.exe
  2⤵
  PID:7924
- C:\Windows\System\aEDfRci.exe
  C:\Windows\System\aEDfRci.exe
  2⤵
  PID:7940
- C:\Windows\System\bUSaCMp.exe
  C:\Windows\System\bUSaCMp.exe
  2⤵
  PID:7956
- C:\Windows\System\VjIipdz.exe
  C:\Windows\System\VjIipdz.exe
  2⤵
  PID:7972
- C:\Windows\System\rboMNff.exe
  C:\Windows\System\rboMNff.exe
  2⤵
  PID:7988
- C:\Windows\System\mFpWByF.exe
  C:\Windows\System\mFpWByF.exe
  2⤵
  PID:8004
- C:\Windows\System\SGVnGuR.exe
  C:\Windows\System\SGVnGuR.exe
  2⤵
  PID:8024
- C:\Windows\System\FVxLkCI.exe
  C:\Windows\System\FVxLkCI.exe
  2⤵
  PID:8040
- C:\Windows\System\xrSiQTu.exe
  C:\Windows\System\xrSiQTu.exe
  2⤵
  PID:8056
- C:\Windows\System\VBKdhuG.exe
  C:\Windows\System\VBKdhuG.exe
  2⤵
  PID:8072
- C:\Windows\System\ZPkbJCY.exe
  C:\Windows\System\ZPkbJCY.exe
  2⤵
  PID:8088
- C:\Windows\System\QJBNanc.exe
  C:\Windows\System\QJBNanc.exe
  2⤵
  PID:8104
- C:\Windows\System\nqycuhh.exe
  C:\Windows\System\nqycuhh.exe
  2⤵
  PID:8120
- C:\Windows\System\DbFUZAP.exe
  C:\Windows\System\DbFUZAP.exe
  2⤵
  PID:8136
- C:\Windows\System\KVwpEGL.exe
  C:\Windows\System\KVwpEGL.exe
  2⤵
  PID:8152
- C:\Windows\System\jCyUGKn.exe
  C:\Windows\System\jCyUGKn.exe
  2⤵
  PID:8168
- C:\Windows\System\vXPYIhV.exe
  C:\Windows\System\vXPYIhV.exe
  2⤵
  PID:8184
- C:\Windows\System\UEIIweJ.exe
  C:\Windows\System\UEIIweJ.exe
  2⤵
  PID:7176
- C:\Windows\System\hPVGxOc.exe
  C:\Windows\System\hPVGxOc.exe
  2⤵
  PID:6196
- C:\Windows\System\NBmdYKB.exe
  C:\Windows\System\NBmdYKB.exe
  2⤵
  PID:7100
- C:\Windows\System\YdamFcH.exe
  C:\Windows\System\YdamFcH.exe
  2⤵
  PID:7224
- C:\Windows\System\ZXvvVzy.exe
  C:\Windows\System\ZXvvVzy.exe
  2⤵
  PID:7292
- C:\Windows\System\mDRnHrT.exe
  C:\Windows\System\mDRnHrT.exe
  2⤵
  PID:7204
- C:\Windows\System\GTNodEL.exe
  C:\Windows\System\GTNodEL.exe
  2⤵
  PID:7344
- C:\Windows\System\aRJQngX.exe
  C:\Windows\System\aRJQngX.exe
  2⤵
  PID:7404
- C:\Windows\System\WwvdfEe.exe
  C:\Windows\System\WwvdfEe.exe
  2⤵
  PID:7420
- C:\Windows\System\ahpffHP.exe
  C:\Windows\System\ahpffHP.exe
  2⤵
  PID:7436
- C:\Windows\System\snETJOP.exe
  C:\Windows\System\snETJOP.exe
  2⤵
  PID:7468
- C:\Windows\System\iJeaAET.exe
  C:\Windows\System\iJeaAET.exe
  2⤵
  PID:7520
- C:\Windows\System\OJPZIai.exe
  C:\Windows\System\OJPZIai.exe
  2⤵
  PID:7532
- C:\Windows\System\pooLXua.exe
  C:\Windows\System\pooLXua.exe
  2⤵
  PID:7612
- C:\Windows\System\XLDrcqN.exe
  C:\Windows\System\XLDrcqN.exe
  2⤵
  PID:7596
- C:\Windows\System\gtPHAZg.exe
  C:\Windows\System\gtPHAZg.exe
  2⤵
  PID:7676
- C:\Windows\System\UmgxhsX.exe
  C:\Windows\System\UmgxhsX.exe
  2⤵
  PID:7660
- C:\Windows\System\HreFNdg.exe
  C:\Windows\System\HreFNdg.exe
  2⤵
  PID:7728
- C:\Windows\System\SVFXjzS.exe
  C:\Windows\System\SVFXjzS.exe
  2⤵
  PID:7760
- C:\Windows\System\QGImWIP.exe
  C:\Windows\System\QGImWIP.exe
  2⤵
  PID:7804
- C:\Windows\System\qYaiFra.exe
  C:\Windows\System\qYaiFra.exe
  2⤵
  PID:7836
- C:\Windows\System\GqnmQpX.exe
  C:\Windows\System\GqnmQpX.exe
  2⤵
  PID:7872
- C:\Windows\System\QxcOEZU.exe
  C:\Windows\System\QxcOEZU.exe
  2⤵
  PID:7932
- C:\Windows\System\BWTHFgq.exe
  C:\Windows\System\BWTHFgq.exe
  2⤵
  PID:7916
- C:\Windows\System\qSsvmtG.exe
  C:\Windows\System\qSsvmtG.exe
  2⤵
  PID:7952
- C:\Windows\System\XwqCCyh.exe
  C:\Windows\System\XwqCCyh.exe
  2⤵
  PID:8000
- C:\Windows\System\OGnLKuH.exe
  C:\Windows\System\OGnLKuH.exe
  2⤵
  PID:8020
- C:\Windows\System\WnzefPC.exe
  C:\Windows\System\WnzefPC.exe
  2⤵
  PID:8096
- C:\Windows\System\nDVfoIs.exe
  C:\Windows\System\nDVfoIs.exe
  2⤵
  PID:8160
- C:\Windows\System\lTIObLv.exe
  C:\Windows\System\lTIObLv.exe
  2⤵
  PID:8084
- C:\Windows\System\HMSGaLv.exe
  C:\Windows\System\HMSGaLv.exe
  2⤵
  PID:7056
- C:\Windows\System\HRZxxPw.exe
  C:\Windows\System\HRZxxPw.exe
  2⤵
  PID:8148
- C:\Windows\System\TSFxoMM.exe
  C:\Windows\System\TSFxoMM.exe
  2⤵
  PID:5700
- C:\Windows\System\eegGFej.exe
  C:\Windows\System\eegGFej.exe
  2⤵
  PID:7220
- C:\Windows\System\UcVGbXi.exe
  C:\Windows\System\UcVGbXi.exe
  2⤵
  PID:7240
- C:\Windows\System\iZWsuxU.exe
  C:\Windows\System\iZWsuxU.exe
  2⤵
  PID:7440
- C:\Windows\System\Fjxlwwi.exe
  C:\Windows\System\Fjxlwwi.exe
  2⤵
  PID:7472
- C:\Windows\System\jwDKRjL.exe
  C:\Windows\System\jwDKRjL.exe
  2⤵
  PID:7372
- C:\Windows\System\SOeDNpd.exe
  C:\Windows\System\SOeDNpd.exe
  2⤵
  PID:7376
- C:\Windows\System\UhhoxFo.exe
  C:\Windows\System\UhhoxFo.exe
  2⤵
  PID:7580
- C:\Windows\System\KZnBeQm.exe
  C:\Windows\System\KZnBeQm.exe
  2⤵
  PID:7552
- C:\Windows\System\ChGZZVR.exe
  C:\Windows\System\ChGZZVR.exe
  2⤵
  PID:8016
- C:\Windows\System\NTdPfuR.exe
  C:\Windows\System\NTdPfuR.exe
  2⤵
  PID:7792
- C:\Windows\System\lMTugPc.exe
  C:\Windows\System\lMTugPc.exe
  2⤵
  PID:7756
- C:\Windows\System\psfHOvc.exe
  C:\Windows\System\psfHOvc.exe
  2⤵
  PID:7948
- C:\Windows\System\ssChJvJ.exe
  C:\Windows\System\ssChJvJ.exe
  2⤵
  PID:7692
- C:\Windows\System\aYDqDqW.exe
  C:\Windows\System\aYDqDqW.exe
  2⤵
  PID:8012
- C:\Windows\System\XpCpMGZ.exe
  C:\Windows\System\XpCpMGZ.exe
  2⤵
  PID:7984
- C:\Windows\System\crkwRbD.exe
  C:\Windows\System\crkwRbD.exe
  2⤵
  PID:8080
- C:\Windows\System\mItDKQo.exe
  C:\Windows\System\mItDKQo.exe
  2⤵
  PID:7288
- C:\Windows\System\WWnFZor.exe
  C:\Windows\System\WWnFZor.exe
  2⤵
  PID:7500
- C:\Windows\System\VqqHuwU.exe
  C:\Windows\System\VqqHuwU.exe
  2⤵
  PID:8144
- C:\Windows\System\BEbUCiH.exe
  C:\Windows\System\BEbUCiH.exe
  2⤵
  PID:7388
- C:\Windows\System\RiaeENS.exe
  C:\Windows\System\RiaeENS.exe
  2⤵
  PID:7648
- C:\Windows\System\VNHfIpl.exe
  C:\Windows\System\VNHfIpl.exe
  2⤵
  PID:7696
- C:\Windows\System\grdckkr.exe
  C:\Windows\System\grdckkr.exe
  2⤵
  PID:7408
- C:\Windows\System\AqotCeF.exe
  C:\Windows\System\AqotCeF.exe
  2⤵
  PID:7856
- C:\Windows\System\hlXcSVU.exe
  C:\Windows\System\hlXcSVU.exe
  2⤵
  PID:8064
- C:\Windows\System\bubSTec.exe
  C:\Windows\System\bubSTec.exe
  2⤵
  PID:8048
- C:\Windows\System\VorNevD.exe
  C:\Windows\System\VorNevD.exe
  2⤵
  PID:3308
- C:\Windows\System\BUpfrJA.exe
  C:\Windows\System\BUpfrJA.exe
  2⤵
  PID:7308
- C:\Windows\System\QamyBhe.exe
  C:\Windows\System\QamyBhe.exe
  2⤵
  PID:7900
- C:\Windows\System\iySKDKP.exe
  C:\Windows\System\iySKDKP.exe
  2⤵
  PID:7920
- C:\Windows\System\VUwwXqe.exe
  C:\Windows\System\VUwwXqe.exe
  2⤵
  PID:7968
- C:\Windows\System\jArHbsb.exe
  C:\Windows\System\jArHbsb.exe
  2⤵
  PID:8200
- C:\Windows\System\pmDYMWF.exe
  C:\Windows\System\pmDYMWF.exe
  2⤵
  PID:8216
- C:\Windows\System\kHVksxA.exe
  C:\Windows\System\kHVksxA.exe
  2⤵
  PID:8236
- C:\Windows\System\bpCCxSA.exe
  C:\Windows\System\bpCCxSA.exe
  2⤵
  PID:8256
- C:\Windows\System\NKFLtNz.exe
  C:\Windows\System\NKFLtNz.exe
  2⤵
  PID:8276
- C:\Windows\System\IHcAXQg.exe
  C:\Windows\System\IHcAXQg.exe
  2⤵
  PID:8292
- C:\Windows\System\NYsaOsH.exe
  C:\Windows\System\NYsaOsH.exe
  2⤵
  PID:8308
- C:\Windows\System\LJYtQDn.exe
  C:\Windows\System\LJYtQDn.exe
  2⤵
  PID:8328
- C:\Windows\System\JRTbqZy.exe
  C:\Windows\System\JRTbqZy.exe
  2⤵
  PID:8344
- C:\Windows\System\MbMZzoG.exe
  C:\Windows\System\MbMZzoG.exe
  2⤵
  PID:8360
- C:\Windows\System\GMUGklE.exe
  C:\Windows\System\GMUGklE.exe
  2⤵
  PID:8376
- C:\Windows\System\aLRtlys.exe
  C:\Windows\System\aLRtlys.exe
  2⤵
  PID:8400
- C:\Windows\System\UCpJdXP.exe
  C:\Windows\System\UCpJdXP.exe
  2⤵
  PID:8416
- C:\Windows\System\YXZHvvj.exe
  C:\Windows\System\YXZHvvj.exe
  2⤵
  PID:8432
- C:\Windows\System\hRVFYpV.exe
  C:\Windows\System\hRVFYpV.exe
  2⤵
  PID:8448
- C:\Windows\System\zTTPnzf.exe
  C:\Windows\System\zTTPnzf.exe
  2⤵
  PID:8464
- C:\Windows\System\yeUGKmh.exe
  C:\Windows\System\yeUGKmh.exe
  2⤵
  PID:8484
- C:\Windows\System\pMgxlzw.exe
  C:\Windows\System\pMgxlzw.exe
  2⤵
  PID:8500
- C:\Windows\System\DJgyHMa.exe
  C:\Windows\System\DJgyHMa.exe
  2⤵
  PID:8516
- C:\Windows\System\MhvCGqa.exe
  C:\Windows\System\MhvCGqa.exe
  2⤵
  PID:8536
- C:\Windows\System\KZBhTzD.exe
  C:\Windows\System\KZBhTzD.exe
  2⤵
  PID:8556
- C:\Windows\System\GOqDFlo.exe
  C:\Windows\System\GOqDFlo.exe
  2⤵
  PID:8588
- C:\Windows\System\LGJlDVI.exe
  C:\Windows\System\LGJlDVI.exe
  2⤵
  PID:8604
- C:\Windows\System\CGlZRHM.exe
  C:\Windows\System\CGlZRHM.exe
  2⤵
  PID:8620
- C:\Windows\System\CWgxFWZ.exe
  C:\Windows\System\CWgxFWZ.exe
  2⤵
  PID:8644
- C:\Windows\System\sUyIsZQ.exe
  C:\Windows\System\sUyIsZQ.exe
  2⤵
  PID:8672
- C:\Windows\System\WmLlJFy.exe
  C:\Windows\System\WmLlJFy.exe
  2⤵
  PID:8692
- C:\Windows\System\fyZXDQp.exe
  C:\Windows\System\fyZXDQp.exe
  2⤵
  PID:8712
- C:\Windows\System\bVgtBmZ.exe
  C:\Windows\System\bVgtBmZ.exe
  2⤵
  PID:8728
- C:\Windows\System\bJGTZRH.exe
  C:\Windows\System\bJGTZRH.exe
  2⤵
  PID:8744
- C:\Windows\System\furMqmd.exe
  C:\Windows\System\furMqmd.exe
  2⤵
  PID:8760
- C:\Windows\System\JBzlmHb.exe
  C:\Windows\System\JBzlmHb.exe
  2⤵
  PID:8776
- C:\Windows\System\WDYIxwL.exe
  C:\Windows\System\WDYIxwL.exe
  2⤵
  PID:8792
- C:\Windows\System\pKVvAnA.exe
  C:\Windows\System\pKVvAnA.exe
  2⤵
  PID:8812
- C:\Windows\System\sgcNckj.exe
  C:\Windows\System\sgcNckj.exe
  2⤵
  PID:8840
- C:\Windows\System\ihjmNAA.exe
  C:\Windows\System\ihjmNAA.exe
  2⤵
  PID:8860
- C:\Windows\System\OtUulBU.exe
  C:\Windows\System\OtUulBU.exe
  2⤵
  PID:8876
- C:\Windows\System\yAMNpMA.exe
  C:\Windows\System\yAMNpMA.exe
  2⤵
  PID:8892
- C:\Windows\System\PkjYhed.exe
  C:\Windows\System\PkjYhed.exe
  2⤵
  PID:8920
- C:\Windows\System\jCTUyVU.exe
  C:\Windows\System\jCTUyVU.exe
  2⤵
  PID:8936
- C:\Windows\System\XmFJbqd.exe
  C:\Windows\System\XmFJbqd.exe
  2⤵
  PID:8952
- C:\Windows\System\ElGsXVG.exe
  C:\Windows\System\ElGsXVG.exe
  2⤵
  PID:8968
- C:\Windows\System\ZnuMVih.exe
  C:\Windows\System\ZnuMVih.exe
  2⤵
  PID:8984
- C:\Windows\System\xreYeYz.exe
  C:\Windows\System\xreYeYz.exe
  2⤵
  PID:9000
- C:\Windows\System\JdUOxVm.exe
  C:\Windows\System\JdUOxVm.exe
  2⤵
  PID:9016
- C:\Windows\System\GMXlKbn.exe
  C:\Windows\System\GMXlKbn.exe
  2⤵
  PID:9032
- C:\Windows\System\tgBAIUR.exe
  C:\Windows\System\tgBAIUR.exe
  2⤵
  PID:9048
- C:\Windows\System\nojetLO.exe
  C:\Windows\System\nojetLO.exe
  2⤵
  PID:9064
- C:\Windows\System\OMIUbQh.exe
  C:\Windows\System\OMIUbQh.exe
  2⤵
  PID:9080
- C:\Windows\System\jmCmCPc.exe
  C:\Windows\System\jmCmCPc.exe
  2⤵
  PID:9096
- C:\Windows\System\yndTyDM.exe
  C:\Windows\System\yndTyDM.exe
  2⤵
  PID:9120
- C:\Windows\System\PtLxlCK.exe
  C:\Windows\System\PtLxlCK.exe
  2⤵
  PID:9140
- C:\Windows\System\igIARtR.exe
  C:\Windows\System\igIARtR.exe
  2⤵
  PID:9160
- C:\Windows\System\KVzdPyp.exe
  C:\Windows\System\KVzdPyp.exe
  2⤵
  PID:9188
- C:\Windows\System\uvbonRO.exe
  C:\Windows\System\uvbonRO.exe
  2⤵
  PID:9204
- C:\Windows\System\PveZYwI.exe
  C:\Windows\System\PveZYwI.exe
  2⤵
  PID:8224
- C:\Windows\System\itGUbzK.exe
  C:\Windows\System\itGUbzK.exe
  2⤵
  PID:8264
- C:\Windows\System\DjcLKIF.exe
  C:\Windows\System\DjcLKIF.exe
  2⤵
  PID:7740
- C:\Windows\System\VhwGhpn.exe
  C:\Windows\System\VhwGhpn.exe
  2⤵
  PID:8444
- C:\Windows\System\ZFlWHqr.exe
  C:\Windows\System\ZFlWHqr.exe
  2⤵
  PID:8428
- C:\Windows\System\fGmEzIk.exe
  C:\Windows\System\fGmEzIk.exe
  2⤵
  PID:8480
- C:\Windows\System\BlQrLtA.exe
  C:\Windows\System\BlQrLtA.exe
  2⤵
  PID:8552
- C:\Windows\System\HvItMQj.exe
  C:\Windows\System\HvItMQj.exe
  2⤵
  PID:8532
- C:\Windows\System\gGrQtaX.exe
  C:\Windows\System\gGrQtaX.exe
  2⤵
  PID:8600
- C:\Windows\System\VLHXkCL.exe
  C:\Windows\System\VLHXkCL.exe
  2⤵
  PID:8632
- C:\Windows\System\WSSLLoJ.exe
  C:\Windows\System\WSSLLoJ.exe
  2⤵
  PID:8652
- C:\Windows\System\zZNcOht.exe
  C:\Windows\System\zZNcOht.exe
  2⤵
  PID:8660
- C:\Windows\System\gAlKyFn.exe
  C:\Windows\System\gAlKyFn.exe
  2⤵
  PID:8704
- C:\Windows\System\XuRNcAn.exe
  C:\Windows\System\XuRNcAn.exe
  2⤵
  PID:8824
- C:\Windows\System\NGzxFeo.exe
  C:\Windows\System\NGzxFeo.exe
  2⤵
  PID:8836
- C:\Windows\System\JjgOqyb.exe
  C:\Windows\System\JjgOqyb.exe
  2⤵
  PID:8768
- C:\Windows\System\pSRwwEQ.exe
  C:\Windows\System\pSRwwEQ.exe
  2⤵
  PID:8856
- C:\Windows\System\rVnQuDc.exe
  C:\Windows\System\rVnQuDc.exe
  2⤵
  PID:8904
- C:\Windows\System\vZYqvTV.exe
  C:\Windows\System\vZYqvTV.exe
  2⤵
  PID:8548
- C:\Windows\System\McQQcqv.exe
  C:\Windows\System\McQQcqv.exe
  2⤵
  PID:8980
- C:\Windows\System\VDjDUlY.exe
  C:\Windows\System\VDjDUlY.exe
  2⤵
  PID:8964
- C:\Windows\System\uvxqIyx.exe
  C:\Windows\System\uvxqIyx.exe
  2⤵
  PID:9112
- C:\Windows\System\qkWrRFq.exe
  C:\Windows\System\qkWrRFq.exe
  2⤵
  PID:9148
- C:\Windows\System\hDAsPmF.exe
  C:\Windows\System\hDAsPmF.exe
  2⤵
  PID:9092
- C:\Windows\System\nVmBFQi.exe
  C:\Windows\System\nVmBFQi.exe
  2⤵
  PID:9172
- C:\Windows\System\XgQeEBc.exe
  C:\Windows\System\XgQeEBc.exe
  2⤵
  PID:8688
- C:\Windows\System\MNtzdvE.exe
  C:\Windows\System\MNtzdvE.exe
  2⤵
  PID:8232
- C:\Windows\System\SAKsJRR.exe
  C:\Windows\System\SAKsJRR.exe
  2⤵
  PID:8212
- C:\Windows\System\KCLCEkQ.exe
  C:\Windows\System\KCLCEkQ.exe
  2⤵
  PID:8336
- C:\Windows\System\MDfiMpD.exe
  C:\Windows\System\MDfiMpD.exe
  2⤵
  PID:8572
- C:\Windows\System\ZXZwfuG.exe
  C:\Windows\System\ZXZwfuG.exe
  2⤵
  PID:8244
- C:\Windows\System\XXohKnF.exe
  C:\Windows\System\XXohKnF.exe
  2⤵
  PID:8324
- C:\Windows\System\ceAYIUt.exe
  C:\Windows\System\ceAYIUt.exe
  2⤵
  PID:8612
- C:\Windows\System\GVkOtHx.exe
  C:\Windows\System\GVkOtHx.exe
  2⤵
  PID:8912
- C:\Windows\System\CxZHCrv.exe
  C:\Windows\System\CxZHCrv.exe
  2⤵
  PID:9072
- C:\Windows\System\qkvwulT.exe
  C:\Windows\System\qkvwulT.exe
  2⤵
  PID:9180
- C:\Windows\System\XRPEtNe.exe
  C:\Windows\System\XRPEtNe.exe
  2⤵
  PID:8392
- C:\Windows\System\QjIRtLZ.exe
  C:\Windows\System\QjIRtLZ.exe
  2⤵
  PID:8524
- C:\Windows\System\fqswIbJ.exe
  C:\Windows\System\fqswIbJ.exe
  2⤵
  PID:8476
- C:\Windows\System\IVepoEE.exe
  C:\Windows\System\IVepoEE.exe
  2⤵
  PID:8724
- C:\Windows\System\xFkmNeS.exe
  C:\Windows\System\xFkmNeS.exe
  2⤵
  PID:8832
- C:\Windows\System\MbMMaxY.exe
  C:\Windows\System\MbMMaxY.exe
  2⤵
  PID:8320
- C:\Windows\System\czsJWnR.exe
  C:\Windows\System\czsJWnR.exe
  2⤵
  PID:9056
- C:\Windows\System\CSIcDyx.exe
  C:\Windows\System\CSIcDyx.exe
  2⤵
  PID:9156
- C:\Windows\System\MHtLsXa.exe
  C:\Windows\System\MHtLsXa.exe
  2⤵
  PID:8208
- C:\Windows\System\tbxESkP.exe
  C:\Windows\System\tbxESkP.exe
  2⤵
  PID:8112
- C:\Windows\System\ZGFQJay.exe
  C:\Windows\System\ZGFQJay.exe
  2⤵
  PID:8784
- C:\Windows\System\OrPLcKF.exe
  C:\Windows\System\OrPLcKF.exe
  2⤵
  PID:8544
- C:\Windows\System\ofrqWox.exe
  C:\Windows\System\ofrqWox.exe
  2⤵
  PID:8668
- C:\Windows\System\aZnwVsS.exe
  C:\Windows\System\aZnwVsS.exe
  2⤵
  PID:8052
- C:\Windows\System\bmYNkjj.exe
  C:\Windows\System\bmYNkjj.exe
  2⤵
  PID:2104
- C:\Windows\System\QPkkvze.exe
  C:\Windows\System\QPkkvze.exe
  2⤵
  PID:8640
- C:\Windows\System\kNxmVZP.exe
  C:\Windows\System\kNxmVZP.exe
  2⤵
  PID:9320
- C:\Windows\System\zvDCAyY.exe
  C:\Windows\System\zvDCAyY.exe
  2⤵
  PID:9348
- C:\Windows\System\fmUwUbj.exe
  C:\Windows\System\fmUwUbj.exe
  2⤵
  PID:9364
- C:\Windows\System\NJGIMgX.exe
  C:\Windows\System\NJGIMgX.exe
  2⤵
  PID:9380
- C:\Windows\System\AoXhxbP.exe
  C:\Windows\System\AoXhxbP.exe
  2⤵
  PID:9396
- C:\Windows\System\mAEkuNC.exe
  C:\Windows\System\mAEkuNC.exe
  2⤵
  PID:9432
- C:\Windows\System\kLlnNNj.exe
  C:\Windows\System\kLlnNNj.exe
  2⤵
  PID:9456
- C:\Windows\System\ZYkFgbY.exe
  C:\Windows\System\ZYkFgbY.exe
  2⤵
  PID:9472
- C:\Windows\System\HyVuxFX.exe
  C:\Windows\System\HyVuxFX.exe
  2⤵
  PID:9488
- C:\Windows\System\ooyuYjE.exe
  C:\Windows\System\ooyuYjE.exe
  2⤵
  PID:9504
- C:\Windows\System\mCsccTq.exe
  C:\Windows\System\mCsccTq.exe
  2⤵
  PID:9520
- C:\Windows\System\NktHdVz.exe
  C:\Windows\System\NktHdVz.exe
  2⤵
  PID:9536
- C:\Windows\System\srNvKiq.exe
  C:\Windows\System\srNvKiq.exe
  2⤵
  PID:9564
- C:\Windows\System\zagHKQO.exe
  C:\Windows\System\zagHKQO.exe
  2⤵
  PID:9608
- C:\Windows\System\tOgoNdu.exe
  C:\Windows\System\tOgoNdu.exe
  2⤵
  PID:9624
- C:\Windows\System\GreCcdX.exe
  C:\Windows\System\GreCcdX.exe
  2⤵
  PID:9640
- C:\Windows\System\JljfGBJ.exe
  C:\Windows\System\JljfGBJ.exe
  2⤵
  PID:9656
- C:\Windows\System\fVejLLd.exe
  C:\Windows\System\fVejLLd.exe
  2⤵
  PID:9672
- C:\Windows\System\NAubjpf.exe
  C:\Windows\System\NAubjpf.exe
  2⤵
  PID:9688
- C:\Windows\System\QIYPNNL.exe
  C:\Windows\System\QIYPNNL.exe
  2⤵
  PID:9704
- C:\Windows\System\AxwfSQt.exe
  C:\Windows\System\AxwfSQt.exe
  2⤵
  PID:9720
- C:\Windows\System\WQOuDBB.exe
  C:\Windows\System\WQOuDBB.exe
  2⤵
  PID:9736
- C:\Windows\System\bzAkVqe.exe
  C:\Windows\System\bzAkVqe.exe
  2⤵
  PID:9752
- C:\Windows\System\ZtYemRN.exe
  C:\Windows\System\ZtYemRN.exe
  2⤵
  PID:9768
- C:\Windows\System\gmxColo.exe
  C:\Windows\System\gmxColo.exe
  2⤵
  PID:9796
- C:\Windows\System\aHLwjHD.exe
  C:\Windows\System\aHLwjHD.exe
  2⤵
  PID:9812
- C:\Windows\System\tcKegwe.exe
  C:\Windows\System\tcKegwe.exe
  2⤵
  PID:9828
- C:\Windows\System\eWXEkgf.exe
  C:\Windows\System\eWXEkgf.exe
  2⤵
  PID:9848
- C:\Windows\System\MclcwoY.exe
  C:\Windows\System\MclcwoY.exe
  2⤵
  PID:9864
- C:\Windows\System\EQUFbNE.exe
  C:\Windows\System\EQUFbNE.exe
  2⤵
  PID:9880
- C:\Windows\System\OZrnOts.exe
  C:\Windows\System\OZrnOts.exe
  2⤵
  PID:9904
- C:\Windows\System\JzPauOf.exe
  C:\Windows\System\JzPauOf.exe
  2⤵
  PID:9920
- C:\Windows\System\omGoPRq.exe
  C:\Windows\System\omGoPRq.exe
  2⤵
  PID:9936
- C:\Windows\System\ShHBDkX.exe
  C:\Windows\System\ShHBDkX.exe
  2⤵
  PID:9964
- C:\Windows\System\iEDeIoL.exe
  C:\Windows\System\iEDeIoL.exe
  2⤵
  PID:9980
- C:\Windows\System\WPKAFWd.exe
  C:\Windows\System\WPKAFWd.exe
  2⤵
  PID:9996
- C:\Windows\System\VnvVivi.exe
  C:\Windows\System\VnvVivi.exe
  2⤵
  PID:10012
- C:\Windows\System\jpRqYEC.exe
  C:\Windows\System\jpRqYEC.exe
  2⤵
  PID:10028
- C:\Windows\System\IrbmbOf.exe
  C:\Windows\System\IrbmbOf.exe
  2⤵
  PID:10044
- C:\Windows\System\ZyldXQe.exe
  C:\Windows\System\ZyldXQe.exe
  2⤵
  PID:10060
- C:\Windows\System\VTylWPI.exe
  C:\Windows\System\VTylWPI.exe
  2⤵
  PID:10076
- C:\Windows\System\eOmssGX.exe
  C:\Windows\System\eOmssGX.exe
  2⤵
  PID:10092
- C:\Windows\System\jsItqoi.exe
  C:\Windows\System\jsItqoi.exe
  2⤵
  PID:10108
- C:\Windows\System\EyhnHki.exe
  C:\Windows\System\EyhnHki.exe
  2⤵
  PID:10124
- C:\Windows\System\DTSBajH.exe
  C:\Windows\System\DTSBajH.exe
  2⤵
  PID:10140
- C:\Windows\System\ZmcPmYs.exe
  C:\Windows\System\ZmcPmYs.exe
  2⤵
  PID:10156
- C:\Windows\System\BilJOfe.exe
  C:\Windows\System\BilJOfe.exe
  2⤵
  PID:10172
- C:\Windows\System\lqrhwBW.exe
  C:\Windows\System\lqrhwBW.exe
  2⤵
  PID:10188
- C:\Windows\System\aZFAUbZ.exe
  C:\Windows\System\aZFAUbZ.exe
  2⤵
  PID:10204
- C:\Windows\System\LaHyhby.exe
  C:\Windows\System\LaHyhby.exe
  2⤵
  PID:10220
- C:\Windows\System\zGCscFO.exe
  C:\Windows\System\zGCscFO.exe
  2⤵
  PID:10236
- C:\Windows\System\SorzesS.exe
  C:\Windows\System\SorzesS.exe
  2⤵
  PID:9336
- C:\Windows\System\huqKAIa.exe
  C:\Windows\System\huqKAIa.exe
  2⤵
  PID:9376
- C:\Windows\System\FubvFOP.exe
  C:\Windows\System\FubvFOP.exe
  2⤵
  PID:9424
- C:\Windows\System\IAgFnta.exe
  C:\Windows\System\IAgFnta.exe
  2⤵
  PID:9468
- C:\Windows\System\fgLvjsZ.exe
  C:\Windows\System\fgLvjsZ.exe
  2⤵
  PID:8680
- C:\Windows\System\qEDFFLC.exe
  C:\Windows\System\qEDFFLC.exe
  2⤵
  PID:8252
- C:\Windows\System\casQSdp.exe
  C:\Windows\System\casQSdp.exe
  2⤵
  PID:8388
- C:\Windows\System\LzOnGAL.exe
  C:\Windows\System\LzOnGAL.exe
  2⤵
  PID:8576
- C:\Windows\System\NOQMiUF.exe
  C:\Windows\System\NOQMiUF.exe
  2⤵
  PID:8976
- C:\Windows\System\hpCldxx.exe
  C:\Windows\System\hpCldxx.exe
  2⤵
  PID:9416
- C:\Windows\System\NCdyJHK.exe
  C:\Windows\System\NCdyJHK.exe
  2⤵
  PID:9388
- C:\Windows\System\MIDIxgk.exe
  C:\Windows\System\MIDIxgk.exe
  2⤵
  PID:7236
- C:\Windows\System\voGgkoG.exe
  C:\Windows\System\voGgkoG.exe
  2⤵
  PID:1148
- C:\Windows\System\WqsjWvq.exe
  C:\Windows\System\WqsjWvq.exe
  2⤵
  PID:8916
- C:\Windows\System\JRswClx.exe
  C:\Windows\System\JRswClx.exe
  2⤵
  PID:8340
- C:\Windows\System\cYJDLUZ.exe
  C:\Windows\System\cYJDLUZ.exe
  2⤵
  PID:8900
- C:\Windows\System\mHNBMTN.exe
  C:\Windows\System\mHNBMTN.exe
  2⤵
  PID:9196
- C:\Windows\System\OdtefCZ.exe
  C:\Windows\System\OdtefCZ.exe
  2⤵
  PID:9012
- C:\Windows\System\WGBEumZ.exe
  C:\Windows\System\WGBEumZ.exe
  2⤵
  PID:9228
- C:\Windows\System\HKHxPpj.exe
  C:\Windows\System\HKHxPpj.exe
  2⤵
  PID:9248
- C:\Windows\System\fbWKnsq.exe
  C:\Windows\System\fbWKnsq.exe
  2⤵
  PID:9268
- C:\Windows\System\XRTPWsa.exe
  C:\Windows\System\XRTPWsa.exe
  2⤵
  PID:9284
- C:\Windows\System\fRzFSLG.exe
  C:\Windows\System\fRzFSLG.exe
  2⤵
  PID:9308
- C:\Windows\System\eBJWVQK.exe
  C:\Windows\System\eBJWVQK.exe
  2⤵
  PID:9392
- C:\Windows\System\lHNIarg.exe
  C:\Windows\System\lHNIarg.exe
  2⤵
  PID:9480
- C:\Windows\System\KMmSovI.exe
  C:\Windows\System\KMmSovI.exe
  2⤵
  PID:9512
- C:\Windows\System\QTntqeU.exe
  C:\Windows\System\QTntqeU.exe
  2⤵
  PID:9516
- C:\Windows\System\JOhOjdo.exe
  C:\Windows\System\JOhOjdo.exe
  2⤵
  PID:9580
- C:\Windows\System\GYQKMZJ.exe
  C:\Windows\System\GYQKMZJ.exe
  2⤵
  PID:9596
- C:\Windows\System\cfdQRBm.exe
  C:\Windows\System\cfdQRBm.exe
  2⤵
  PID:9636
- C:\Windows\System\kQEbCoe.exe
  C:\Windows\System\kQEbCoe.exe
  2⤵
  PID:9696
- C:\Windows\System\xUgXLCJ.exe
  C:\Windows\System\xUgXLCJ.exe
  2⤵
  PID:9760
- C:\Windows\System\jCDBEBw.exe
  C:\Windows\System\jCDBEBw.exe
  2⤵
  PID:9616
- C:\Windows\System\VsgnTlq.exe
  C:\Windows\System\VsgnTlq.exe
  2⤵
  PID:9712
- C:\Windows\System\HsedSFS.exe
  C:\Windows\System\HsedSFS.exe
  2⤵
  PID:9804
- C:\Windows\System\KJALeKX.exe
  C:\Windows\System\KJALeKX.exe
  2⤵
  PID:9872
- C:\Windows\System\KfEpGJq.exe
  C:\Windows\System\KfEpGJq.exe
  2⤵
  PID:9916
- C:\Windows\System\TmRNrdQ.exe
  C:\Windows\System\TmRNrdQ.exe
  2⤵
  PID:9824
- C:\Windows\System\qgwQkkE.exe
  C:\Windows\System\qgwQkkE.exe
  2⤵
  PID:9888
- C:\Windows\System\RMCOAPm.exe
  C:\Windows\System\RMCOAPm.exe
  2⤵
  PID:9892
- C:\Windows\System\AVfPOTP.exe
  C:\Windows\System\AVfPOTP.exe
  2⤵
  PID:9972
- C:\Windows\System\EWqmzXN.exe
  C:\Windows\System\EWqmzXN.exe
  2⤵
  PID:10040
- C:\Windows\System\EtoNtsy.exe
  C:\Windows\System\EtoNtsy.exe
  2⤵
  PID:10084
- C:\Windows\System\XAQPEVH.exe
  C:\Windows\System\XAQPEVH.exe
  2⤵
  PID:10120
- C:\Windows\System\xETspce.exe
  C:\Windows\System\xETspce.exe
  2⤵
  PID:10184
- C:\Windows\System\VAyCgNl.exe
  C:\Windows\System\VAyCgNl.exe
  2⤵
  PID:10104
- C:\Windows\System\vzXOMhw.exe
  C:\Windows\System\vzXOMhw.exe
  2⤵
  PID:9328
- C:\Windows\System\vKAJzzq.exe
  C:\Windows\System\vKAJzzq.exe
  2⤵
  PID:8408
- C:\Windows\System\bqmWSwK.exe
  C:\Windows\System\bqmWSwK.exe
  2⤵
  PID:8852
- C:\Windows\System\nKufPkt.exe
  C:\Windows\System\nKufPkt.exe
  2⤵
  PID:8372
- C:\Windows\System\LRdqIgu.exe
  C:\Windows\System\LRdqIgu.exe
  2⤵
  PID:2368
- C:\Windows\System\ROITpTv.exe
  C:\Windows\System\ROITpTv.exe
  2⤵
  PID:9528
- C:\Windows\System\fSEnHrt.exe
  C:\Windows\System\fSEnHrt.exe
  2⤵
  PID:8356
- C:\Windows\System\OJCYGzl.exe
  C:\Windows\System\OJCYGzl.exe
  2⤵
  PID:8316
- C:\Windows\System\lVkUsCI.exe
  C:\Windows\System\lVkUsCI.exe
  2⤵
  PID:8700
- C:\Windows\System\QnIhWOF.exe
  C:\Windows\System\QnIhWOF.exe
  2⤵
  PID:9264
- C:\Windows\System\CYMPovX.exe
  C:\Windows\System\CYMPovX.exe
  2⤵
  PID:9280
- C:\Windows\System\MIqHQRM.exe
  C:\Windows\System\MIqHQRM.exe
  2⤵
  PID:9024
- C:\Windows\System\fCInlLV.exe
  C:\Windows\System\fCInlLV.exe
  2⤵
  PID:9292
- C:\Windows\System\FkwsSiS.exe
  C:\Windows\System\FkwsSiS.exe
  2⤵
  PID:9776
- C:\Windows\System\DdTXLNQ.exe
  C:\Windows\System\DdTXLNQ.exe
  2⤵
  PID:9484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BNHzQpv.exe

Filesize
1.9MB

MD5
9ea28fa9e145ac4ab470c61969b538b4

SHA1
b12909b4d0f9df8c3337cc76e11ca34cb8ac0563

SHA256
f17ff839aa5a679e1b87a07c17452964f5604a9ae2bfd8f9a26471cc5008bf71

SHA512
63fecc090f9ef35e2b107e893483582d7ce3fcaaa38eb6243925ab47ddf6479f30026dbbe1d04a4d964a4cac4937969d3c3897ad18fc9ea6f34c25863ac6df1c

Download Submit
C:\Windows\system\GzJTTsM.exe

Filesize
1.9MB

MD5
5e3c811c07be16fa66c0ca1e74099ed7

SHA1
291c6a79b61c8c56c58ce79df9a84682acce039f

SHA256
6ecd5aafbb86c1713e977a266791d9293db1d39f9ee8ce2e718ecb808d84d922

SHA512
a09d7955b09610945aed77fd49a99b898c0343dd2b4d5e8b760d77b584cce5b4dc12cb8db8881e49c5f769e40f03985239ed4c447da7a935ccbad401c240ec93

Download Submit
C:\Windows\system\JEUMztC.exe

Filesize
1.9MB

MD5
be38b25d8a9ff7c9e8afd92b780b0884

SHA1
d44aa1ea597320b75686cbfbbfdb8744dc0cfc70

SHA256
3d66c1a6437a640f42a76a8300ff48d7284c6e2a885533c1ae94ece1b8df6f76

SHA512
e5160aa3ea91f38d65036b37a85e1da970206db0bb3d6ce95d1a187fc9276e9272e1dd7063d17f475bdc69ad66f2e271aa9d8bb4ac882fc5bdc8714c0eb681a7

Download Submit
C:\Windows\system\NaztPUF.exe

Filesize
1.9MB

MD5
41161ef78e26d95a0bf5e911f2c3f40b

SHA1
22c12752d77ce03ee8b884d303268d6f5deab2e9

SHA256
9c4d016aab953fe50df54c254f7fe69ccf88db644c26c4b0d5ff444a1498fb9a

SHA512
8238d50efa8edf07a735ccc72bf598fae095520f8c53259e545014611e0c9df1715bf5069e6b18aefe862bbc7d799b2a45cab8046264bcb58b80a6ce2e982b07

Download Submit
C:\Windows\system\OYIkFDo.exe

Filesize
1.9MB

MD5
de0a836ae4d8ffdbf0e742a9e8d56324

SHA1
77f5b00656ed8fb0dac534e57699210299854de2

SHA256
864712efa47c9d34bcc1c14bbd1c5775b9b636b0dc2c93a929e8253ef44c2197

SHA512
6c9df842dabe31cf67775e34a885e028412e833304b9597cd2f1c3091fb2a21b94c71e47a1607058f6bb432e6988c2de95b35c2cdaaec5faa1f8f4ccc02308d1

Download Submit
C:\Windows\system\PmlrfYR.exe

Filesize
1.9MB

MD5
bddb25bef4d2905968415fa66cb7a845

SHA1
4a73582a2706726e3eb1322c71ad239ab1acb88c

SHA256
1bb9684de27d643de8425a7c345dbc429cfb3dd93181db15ae6c6453c7652a32

SHA512
651f6913735224440424ce97eb0d9e2643ab2c7eb9d85e687da3360debed9acb43ca1fc99bd8679a0a0a52f4fad09d777bb2ecc87d76a605a28ada0e6c4b76c8

Download Submit
C:\Windows\system\QmuULNl.exe

Filesize
1.9MB

MD5
5698aab1240ddb06531e765775ba82bd

SHA1
6579846fdfc76bde1eb244f7d7728d27f3c7d3c2

SHA256
56fe274b29622690f47c45b0fa4fa322e2a56bc44dec006d29fc21cf39eeafe1

SHA512
27e29f6c686c2995631dd12451989aadbc54c8975a730d6e7e611ae5b56d6994cf9c735fb1dd710f26c3655d6bc9c7fea1c413a055eaef965a82e6aa5653c1a5

Download Submit
C:\Windows\system\RIiVJsD.exe

Filesize
1.9MB

MD5
269e0b014e96116c45c4fd36df122b3a

SHA1
fe6a66fcdf76d76cc1b1f786bf0a0435ddefd33b

SHA256
3226b9ef520452cbb2992c7233aa6843495c03c7ea3abfdd1a80db28beef22f4

SHA512
63ba2a7a78eb92d4c21b890c8d86436de4fbc13874ed598f5313d412fe35face1f0b4ad6b509dfbf59845d1beafa63835c86ba55217aee81506dbc6834f79920

Download Submit
C:\Windows\system\RUKPxMM.exe

Filesize
1.9MB

MD5
2f06ce0c375d38c56fa8eb19e10108ff

SHA1
bcb0ab8b1584539ffd65922622109616bb4dd29e

SHA256
184ced1ad573691b2573a2a8a941292805d23a5172e9422b348d9e3d9a0c931b

SHA512
7cc13228d0020fe656a901824f35bf51dfba3c22e80b15888b1608ae45f7e1a3e5fdb66c3b8515fac0b786a412fd54b24f1cb1db51535938a75b27594194c7ee

Download Submit
C:\Windows\system\YTvHgEA.exe

Filesize
1.9MB

MD5
8af6295ef92a56fe2a0d09bee7be8261

SHA1
295818b9f2a091e14677f3b1e2d54ed5539c19c8

SHA256
c68bd5c6d34e15ff74eeead1d12d2a67d52cc57b65e8f20c149ea01b1f58236a

SHA512
fbef0460d11033d39e7528c1858a97ceb20af8018206c1171310ff2bcf8bf1dc7700f992d4356f4789cc33436ee37e2236c37ad3128bbbf33b37dcfc609daed7

Download Submit
C:\Windows\system\cuoWdkg.exe

Filesize
1.9MB

MD5
2d54933b5902996e91e9d635c3359162

SHA1
548cb3a52066dac08492e452bdc003d2e5cfc68d

SHA256
096516c17df7d80a9392525f503b511e72d30a902ed5e77e3aafb0b61ca826bc

SHA512
cf8c3b39f436d9b2ac90922243fc96e3e2cb9cdc562dd52790c61e844c11eae21c408b2acc902bac5812f6bf9bad1b2ffa76acb7d19d748f56f5498b2c2b90e8

Download Submit
C:\Windows\system\gCvjbNu.exe

Filesize
1.9MB

MD5
f8a73450b451ce93c2b7c848094624cc

SHA1
f5db8d6a44c786b7c4a462f494cdc387f0feea5c

SHA256
88a37f74ced15880b2cbd22258fa1a75df09b84a0d11df1ab4952cce7dd1f8e8

SHA512
5f9466b235a468e3db3b36cb149dc14d420e017ab629f85941bdfe66d682d6fbf34ac10d392d38ff2dd293277b510b18373df8647d4c8a12bf44928dee1492f9

Download Submit
C:\Windows\system\gXWUPrx.exe

Filesize
1.9MB

MD5
6719c0089042e953b413a1c30756ab57

SHA1
c605a53ace2336cc121cf01931bac71388c9afc0

SHA256
43aa5c3ab357982aaccbc8a42b47d834b1e35f964a59c6e0b8ee9d8da5f73364

SHA512
090b8aa5231c62d33a6574d494c0fecef125960cec1d0dff5af034644d18d8b38580dde3cd2f3c8882c06ef00f17f32111b5a7082f541d3caa42f869849d0d94

Download Submit
C:\Windows\system\iiBEUCY.exe

Filesize
1.9MB

MD5
2eec15291a30887587fe38c403ed615a

SHA1
01f62a5b70d0e80607429629be1c872f08178dcf

SHA256
9160f5a50550c5f3e79775e8e5e71bb9b8960786e13f415b862945888cb52982

SHA512
1d69b7cd630084e729fc42b6f6a09bf81e1ead8e900b50076d874b0c76ca18b0b9f839f37f4fb97f3b1cf5a31bcc48e009d5a8f766835b91c095e96561829861

Download Submit
C:\Windows\system\lErTscH.exe

Filesize
1.9MB

MD5
e7e7f74b77a19f8ebbc4e90bf2384ec1

SHA1
e1474e7240af9eb3469e56c9fc9ac8f25ae24929

SHA256
408286d9653bc23b780c3bab7251611eddb9c09c4a21971647c501ddafbf76f6

SHA512
58f8e31d87225e958716bdb8333c148f6194e5762eb19b9811f6c68a94b96b694f3bc05d7bf73287d5ca60129d3a0b25c2584dbb6e63549e5f25174aef4ff8ef

Download Submit
C:\Windows\system\lSRaFFT.exe

Filesize
1.9MB

MD5
5a0e166f94403b270c06b6fc3daf8ca4

SHA1
73d05d63ab9ce7570782938479d55c9dae81b158

SHA256
c31b8ad30562ba15c1376350eab4cd3308765ded1ec417cb2098e0bc195a814c

SHA512
3f2bb52746268a71ff117b095f3bcbb5e135c063e3997f4856d202234a39a26f955b2672f4c7fe9ec8c48c8b718fc4d614f8362c757318dc59fa9df4d92da01a

Download Submit
C:\Windows\system\meDXjqA.exe

Filesize
1.9MB

MD5
b5b751a1d746f1d34320ba38e29aff9b

SHA1
ce8f0508a02e01d9ae8b5d0bc01258aa99a32817

SHA256
a565d381f0a78294162db0e266be790827678f3d5d04e50d02e8a08583654978

SHA512
1a005966f4d24bbd9d4327f30b8b051195178f1fe2ded36dd11f2f25db288ef051756c234ca428ca025a7be7a7571d5a39f8304f934f6efe5188a5e0cb5d9d81

Download Submit
C:\Windows\system\odAOnPy.exe

Filesize
1.9MB

MD5
b344d1003d161ea4c2cd0084e59093a7

SHA1
de7a2a5c35c0fea4c0d4fa8846ce8e91cdd4cea0

SHA256
b3463d16c2418cdb05eba7b6191ed9aee64b32a75e7cee4ad7458efc71402590

SHA512
236ccfe32b5279db6da043756f333af5dd2f1f065a9a55ba2bd7cfb936923d98747b14037356803ba1bfb00830b8f77b12f70abbf7ea2bfc99547a0e9243ac77

Download Submit
C:\Windows\system\sIGHIfC.exe

Filesize
1.9MB

MD5
50a74d1b447f85edc236dbbce2cbe4de

SHA1
156ba3943135f281255939025cc36535ca33c142

SHA256
a70b3ff7fb0e51d674532edb3977dd549f8fe86ef1d27b4b0232d9899101638b

SHA512
9467851efff867d2c06fbab961dea76676904eb198c93bd664152de6947228503b2e6946b228a44786895a5a0a8152b0aee83a251a8c728a8b205e404ba04f87

Download Submit
C:\Windows\system\sMEzMOq.exe

Filesize
1.9MB

MD5
69044b96498de8182c133d7c2f5f41d7

SHA1
5293405fc2e1e2ac2105133f4598c1359a9231be

SHA256
f14a185991df44ad273dfb8c7a95917a5bc49ecc700b3b39ebaca999c5723f4b

SHA512
d91b367e6d41f80000c83050775bf8665a46d81a18df0f295ab9817e3ae008082c236f5d95e190d4aefca49d450c55adbbfab92916885159225394c893b86ec3

Download Submit
C:\Windows\system\tfTuins.exe

Filesize
1.9MB

MD5
fcb133b46469e06a8b1cd23b64d24c52

SHA1
aa606709efb039fe73c91be397f2d1c3a20a7b27

SHA256
c2a6288479d13bad8cd4d51e5910efe2ce446ccd2e1b707bd1cd49a6f5d7865c

SHA512
0b934268bf82706db57f041b14e817c2d6a58b162a98aaa5a6c0fe9e332462f2ae8eed13aa68f16e6e97a0450ff094674531266e0f724241a5c3cf2b788fa729

Download Submit
C:\Windows\system\uQewJen.exe

Filesize
1.9MB

MD5
9ecdf95ed656ced7f91a11aba6ee33b8

SHA1
330697cd15e36c6cbc5f01379b5182856d3fe6e7

SHA256
03bb7bef8872b9fc2e75c33b09ecbe53e24832ffb6317d6c2a8baae165ff6702

SHA512
46bd0d25c123ce36e1795d1fa677b2d51df0968ee5a52e600d3820df1d817d3ef619098cd698fd675aed140d7663e6d1b63eeb51f8d933c16224329972f48044

Download Submit
C:\Windows\system\ujWPsUj.exe

Filesize
1.9MB

MD5
2dd53ba3a9b30ffb7b68316b2236bc40

SHA1
c75b99718f845920169e3331e71e618cdcc4154b

SHA256
a0df6cb53aa9b42985487e4e10836bbf2962ef640482595d7f2ffeb824b5cdd7

SHA512
1c3eb16221f69ebe7cf86f3080123234df523c376fcd92ff42615a948711c1a5263a0beeec8ca83fa085134dd17b693dfb62c82e92879d527dc13fd7270da45c

Download Submit
C:\Windows\system\yBJYtSV.exe

Filesize
1.9MB

MD5
6a1cc9b8d1ceb3f9cd5d397e7ca489bf

SHA1
74e58e7661369b90c170204fd913ada7302f0a6b

SHA256
025eef1e21479eba82ab564e4e3e6c9f6ef034304aadcfe480efb18e4d833fde

SHA512
351b7ad567cda8d64e1b120aa4511e63a93931373b150a5f73e7eb4ccdd9dc97983f1247ca289be7b42e425aa38d237a5161f93173862ff0c04c02005ab926bd

Download Submit
\Windows\system\EXBTstT.exe

Filesize
1.9MB

MD5
50481697e01966f09c0db7a5a25304f7

SHA1
2460d2bac435c830245c65ed1b2504fb55bbdfa4

SHA256
bba377cfdc1b26bba892c3d3c9bd7a507b9a998dd16f276d488fda80a11517da

SHA512
fc1a53f0e2f56f72939cfa8ba3f2b5b4097bc459c10b60de1343da28f29efadc22a8182e69e19348780b3a652a91c7730cd0377d8cfdb36e142683df1222a2e7

Download Submit
\Windows\system\KxcOPab.exe

Filesize
1.9MB

MD5
20eb8bfb3ce540703830d21ed771b0e3

SHA1
b91f996b3bf16a1a66b0fc9802a37812310cb427

SHA256
fafd45f9946b44614fd596a2b9e65c78c39c0765cd073173b8ebd308cc4aaebe

SHA512
16c1f2676ccd7e98c85d4be251e5d1d148b2c628ba899729ca4ffbc876cff66523916b243904213fb01a91c7f2b8651a28e808874756859a2513e1204e082094

Download Submit
\Windows\system\WvITBpU.exe

Filesize
1.9MB

MD5
f6cac8cde704000f542e30aca0ec5880

SHA1
1c230ba249111c602193385af8e9203e25fe96f0

SHA256
3681a6f54c37f5c8aa1cc9525a52493c69ccde9bec3bdf1fd1b41301410cc4fc

SHA512
d0a564580b9cc9264327cdb47f619d73c27a53ba651e4a56542a83675384c625bacb2d2988245a9f9fb163596d148fad975fe249882a43b4a0b4489723ebf704

Download Submit
\Windows\system\eRjDMOV.exe

Filesize
1.9MB

MD5
557ba1dae4cf383ca2440c34083bd8d2

SHA1
879e70c7275bbc48afaece3a0d90b4706db08b13

SHA256
6534d44d933da402c43e1f71d50b338dc56701b65538a3fc3918d130af9ee4ce

SHA512
483a4c07cfd49bcfd86c31db8b6beeefd00f995a7f51a2b630abd7e0c2843f8c4053dc980a9a65a24aede6a45a1c542d3499322c4b41bc2f35199ca7322bd1e5

Download Submit
\Windows\system\etNkOrl.exe

Filesize
1.9MB

MD5
859a33cd0b7dbff05cfe89e2b15b85c2

SHA1
a7621974c2a7c63b9a7747fa42e1fa1ccad02577

SHA256
3455aec19a23e5680a57639170d8d720158ff4a253bf7086efb8cf59d75c23c5

SHA512
65568950f5be54395a46fe2c9f1590bad5daf96a54fdf101223a9d4ac27d967523d1129f1353559bb0690b2751b016d04c7ac3d7da074e2e093686d494597dec

Download Submit
\Windows\system\fIZrxvw.exe

Filesize
1.9MB

MD5
6c8810a5a9af32cefb81728a1e0b6899

SHA1
68ce1841205b4ac57a72bcbda64046b5881186bf

SHA256
dde74bb5e3ceb8ccd8c4093e21b70d002b4e9b2a5e510822c570482adf3e1469

SHA512
78e3c9b598fedd1f0827606cc78f59427f82ebca1d82ed922b540f8f6db6cc9ea091042e71329db927190026dd320d5edaf0e9d6292661650c6ae4ea075b34f9

Download Submit
\Windows\system\rprfLTG.exe

Filesize
1.9MB

MD5
cae4255af9f340a544f9ff4bc40cf156

SHA1
297ff7e4ee9dc507d46bb0635e43896e552dfca0

SHA256
601c38b834973656992922ed1c5a81cba8153fddaf8802e4f810a4bdda2637a1

SHA512
03381a48bb5ff76270ff51f2e256ac22511d33b6236aa0668b072efaf1d481c364823c1d5e394de572d15eb8687fda1b96c72b7349ac2854bc8559db355ff039

Download Submit
\Windows\system\yqDsQJU.exe

Filesize
1.9MB

MD5
7d60d4adf06978af3d1c30e687fafd4f

SHA1
a414e616a59faf1ae7292ae5df237d21f3c805c3

SHA256
39f88d97cddae24c622889426064ec1ffc9d99347ca9d3d9f55d990454537d7e

SHA512
9d6843630e0cdf882a645fbce6fdcbf633d5562323ed850e3fdd788347f340e4c27546e7ebd995876fd5393f946d23523fa6e3e6ee1e6ca6a392de29fef56131

Download Submit
memory/240-2310-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/240-73-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/1072-81-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/1072-2323-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/1264-75-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/1264-2318-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/1348-87-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/1348-2322-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-29-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-2262-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-51-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-2308-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-2326-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-93-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-16-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-60-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-2305-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-50-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-2302-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-41-0x0000000002800000-0x0000000002880000-memory.dmp

Filesize
512KB

Download
memory/2680-62-0x000000001B280000-0x000000001B562000-memory.dmp

Filesize
2.9MB

Download
memory/2680-63-0x0000000002450000-0x0000000002458000-memory.dmp

Filesize
32KB

Download
memory/2776-85-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2776-38-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2776-2266-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2892-61-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2892-0-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2892-13-0x0000000003260000-0x0000000003652000-memory.dmp

Filesize
3.9MB

Download
memory/2892-78-0x0000000003260000-0x0000000003652000-memory.dmp

Filesize
3.9MB

Download
memory/2892-31-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-6-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2892-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2892-57-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-86-0x0000000003260000-0x0000000003652000-memory.dmp

Filesize
3.9MB

Download
memory/2892-25-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-34-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2892-42-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2892-48-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2892-74-0x0000000003260000-0x0000000003652000-memory.dmp

Filesize
3.9MB

Download
memory/2892-173-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2984-2274-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-58-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3032-49-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/3032-2161-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/3032-9-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download