xmrig | 541701ca67b696948b461eb5cbab1251e1c996e6c4f1fe2a4f5628831f12b18d

Analysis

max time kernel
46s
max time network
40s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
Size

1.8MB
MD5

09be8a627a73540fb1d9a52901d1a7dd
SHA1

6f9f640e2d5394c98d09caeb9f1ce4cce84e2f39
SHA256

541701ca67b696948b461eb5cbab1251e1c996e6c4f1fe2a4f5628831f12b18d
SHA512

5794a33eb4952761cd900935b15635c44396967160198aeb281a9388e8e9a2f480317a329fc24869bf85a9b43c2ec4022bd11a2d46df7c897295ff6f9daf948d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrI5t:NABP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2704-285-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2676-270-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2820-269-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2616-267-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2656-265-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2508-264-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2596-255-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/1296-33-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/2644-42-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2596-3705-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2644-3704-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/1296-3707-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/2656-3732-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2820-3795-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2676-3915-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2616-3731-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2508-3724-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2704-3711-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1296	lRdjhUY.exe
2644	cPMRyCk.exe
2596	ppfEcaE.exe
2508	GSrfQie.exe
2704	ejJQGHN.exe
2656	llapIkO.exe
2616	cdYyYwJ.exe
2820	WucPNQV.exe
2676	ROgPziQ.exe
3032	NFedEzF.exe
2544	zkXpnyU.exe
344	SXVWWdk.exe
2732	OZzscJw.exe
2796	UTbQMIH.exe
2844	gPrOjCB.exe
2688	FSeFgFA.exe
1608	DBxhGAB.exe
1804	wXshaNg.exe
792	OELnFod.exe
1560	CDfARot.exe
1816	AXPBHeh.exe
1684	fcBcuOU.exe
2488	mqRzmSw.exe
2392	UdkcaHE.exe
2372	wVWscTw.exe
2276	ZHCchBD.exe
2940	DCFgPDu.exe
668	lvDlXpu.exe
284	baxzxks.exe
2164	CGOMKdf.exe
1656	WaxESPA.exe
2176	GKNyBtZ.exe
1156	PmIqcFE.exe
828	hbWDeEE.exe
1544	xpcfAWx.exe
1252	eRZbSvU.exe
1048	BLltnGU.exe
688	kLDAmKh.exe
2144	PJhZxxY.exe
608	xoyvHVK.exe
2316	nxjqGnn.exe
1512	CgTvwvZ.exe
1056	EGHNguh.exe
2416	VUbWXRL.exe
2760	NTnVYZe.exe
1612	SNgWhBG.exe
1820	QldHmRa.exe
1132	boPLLpo.exe
2324	YYBolCY.exe
1968	xCrKKld.exe
1376	BTshknK.exe
3020	veVnSkd.exe
752	bunagaV.exe
2908	SksgMrm.exe
1552	xwKuZcB.exe
3040	MjboqGC.exe
1184	vYImoIa.exe
760	rdshsDn.exe
1124	BPySwXS.exe
2920	TzjMxJG.exe
1720	nVaqbRL.exe
2520	IpGXOeJ.exe
2192	amkhNpF.exe
880	CTnnFTi.exe

Loads dropped DLL 64 IoCs

pid	Process
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1936-0-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/files/0x0006000000016a3a-61.dat	upx
behavioral1/files/0x0008000000015ca9-46.dat	upx
behavioral1/files/0x0006000000016c3a-70.dat	upx
behavioral1/files/0x0006000000016c5b-79.dat	upx
behavioral1/files/0x0006000000016ccd-89.dat	upx
behavioral1/files/0x0006000000016d01-99.dat	upx
behavioral1/files/0x0006000000016d19-109.dat	upx
behavioral1/files/0x0006000000016d2d-119.dat	upx
behavioral1/files/0x0006000000016d4f-140.dat	upx
behavioral1/files/0x0006000000016d5f-149.dat	upx
behavioral1/files/0x0006000000016d79-170.dat	upx
behavioral1/files/0x0006000000016fa9-167.dat	upx
behavioral1/memory/2704-285-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2676-270-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2820-269-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2616-267-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2656-265-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2508-264-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2596-255-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/files/0x000600000001708c-171.dat	upx
behavioral1/files/0x0006000000016d7d-164.dat	upx
behavioral1/files/0x0006000000016d73-154.dat	upx
behavioral1/files/0x0006000000016d57-143.dat	upx
behavioral1/files/0x0006000000016d3e-129.dat	upx
behavioral1/files/0x0006000000016d46-134.dat	upx
behavioral1/files/0x0006000000016d36-124.dat	upx
behavioral1/files/0x0006000000016d21-114.dat	upx
behavioral1/files/0x0006000000016d10-104.dat	upx
behavioral1/files/0x0006000000016cf2-94.dat	upx
behavioral1/files/0x0006000000016ca1-84.dat	upx
behavioral1/files/0x0006000000016c57-73.dat	upx
behavioral1/files/0x0007000000015ced-58.dat	upx
behavioral1/files/0x0008000000015cd8-55.dat	upx
behavioral1/files/0x00070000000167e8-53.dat	upx
behavioral1/memory/1296-33-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/files/0x0037000000015b72-23.dat	upx
behavioral1/files/0x0008000000016591-50.dat	upx
behavioral1/memory/2644-42-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/files/0x0007000000015ce1-39.dat	upx
behavioral1/files/0x00130000000054a8-27.dat	upx
behavioral1/files/0x0037000000015bb5-14.dat	upx
behavioral1/files/0x000c000000012279-6.dat	upx
behavioral1/memory/2596-3705-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2644-3704-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/1296-3707-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/memory/2656-3732-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2820-3795-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2676-3915-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2616-3731-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2508-3724-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2704-3711-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RXUmVAF.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\wAcnDde.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\KzgelFO.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\nctZyTa.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\CbKwQyY.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\egZnRzS.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\hxgNACv.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\qoNjzPC.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\xgNlZkt.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\IpGXOeJ.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\XgltRQW.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\QjdgrbY.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\vnUrXDc.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\WOkkMmG.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\TuGPqWc.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\DCFgPDu.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\PVtjPkf.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\VKeUatx.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\WomTtUb.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\dzkzGpY.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\kLhNowL.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\kOmfBOO.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\TeFEgzt.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\AAMJIks.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\wOUWOEH.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\trGGaMR.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\WZqFgvd.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\YdyZBBk.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\BoHJwgn.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\iAvozgG.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\VGMEpQa.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\gIzddek.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\crGHDNv.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\nKEDfYX.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\GSkWlTg.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\OgKfRiQ.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\qnqIFws.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\UHdMfAK.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\SbMOeAS.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\xoyvHVK.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\sOaQdCc.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\gntiKjV.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\JwxkzQV.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\tzcsAVb.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\jRKnPLV.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\ncNPHNo.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\MmTFiZR.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\FgbHBgs.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\uHqfSom.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\FSeFgFA.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\jAIINdT.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\HZJWafk.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\DySksiT.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\cMdmkEz.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\hSkYuCS.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\dnkOsxI.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\yYGJYFc.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\KvOXyju.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\oGOtwEg.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\BvGonQE.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\twlcbcK.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\pDdemQP.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\iAzcgGz.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
File created	C:\Windows\System\bCFcvRH.exe	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2584	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeLockMemoryPrivilege	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2584	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	29
PID 1936 wrote to memory of 2584	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	29
PID 1936 wrote to memory of 2584	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	29
PID 1936 wrote to memory of 1296	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	30
PID 1936 wrote to memory of 1296	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	30
PID 1936 wrote to memory of 1296	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	30
PID 1936 wrote to memory of 2596	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	31
PID 1936 wrote to memory of 2596	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	31
PID 1936 wrote to memory of 2596	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	31
PID 1936 wrote to memory of 2644	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	32
PID 1936 wrote to memory of 2644	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	32
PID 1936 wrote to memory of 2644	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	32
PID 1936 wrote to memory of 2656	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	33
PID 1936 wrote to memory of 2656	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	33
PID 1936 wrote to memory of 2656	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	33
PID 1936 wrote to memory of 2508	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	34
PID 1936 wrote to memory of 2508	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	34
PID 1936 wrote to memory of 2508	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	34
PID 1936 wrote to memory of 2820	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	35
PID 1936 wrote to memory of 2820	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	35
PID 1936 wrote to memory of 2820	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	35
PID 1936 wrote to memory of 2704	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	36
PID 1936 wrote to memory of 2704	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	36
PID 1936 wrote to memory of 2704	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	36
PID 1936 wrote to memory of 2676	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	37
PID 1936 wrote to memory of 2676	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	37
PID 1936 wrote to memory of 2676	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	37
PID 1936 wrote to memory of 2616	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	38
PID 1936 wrote to memory of 2616	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	38
PID 1936 wrote to memory of 2616	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	38
PID 1936 wrote to memory of 2544	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	39
PID 1936 wrote to memory of 2544	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	39
PID 1936 wrote to memory of 2544	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	39
PID 1936 wrote to memory of 3032	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	40
PID 1936 wrote to memory of 3032	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	40
PID 1936 wrote to memory of 3032	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	40
PID 1936 wrote to memory of 344	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	41
PID 1936 wrote to memory of 344	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	41
PID 1936 wrote to memory of 344	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	41
PID 1936 wrote to memory of 2732	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	42
PID 1936 wrote to memory of 2732	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	42
PID 1936 wrote to memory of 2732	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	42
PID 1936 wrote to memory of 2796	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	43
PID 1936 wrote to memory of 2796	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	43
PID 1936 wrote to memory of 2796	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	43
PID 1936 wrote to memory of 2844	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	44
PID 1936 wrote to memory of 2844	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	44
PID 1936 wrote to memory of 2844	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	44
PID 1936 wrote to memory of 2688	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	45
PID 1936 wrote to memory of 2688	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	45
PID 1936 wrote to memory of 2688	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	45
PID 1936 wrote to memory of 1608	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	46
PID 1936 wrote to memory of 1608	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	46
PID 1936 wrote to memory of 1608	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	46
PID 1936 wrote to memory of 1804	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	47
PID 1936 wrote to memory of 1804	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	47
PID 1936 wrote to memory of 1804	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	47
PID 1936 wrote to memory of 792	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	48
PID 1936 wrote to memory of 792	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	48
PID 1936 wrote to memory of 792	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	48
PID 1936 wrote to memory of 1560	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	49
PID 1936 wrote to memory of 1560	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	49
PID 1936 wrote to memory of 1560	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	49
PID 1936 wrote to memory of 1816	1936	09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09be8a627a73540fb1d9a52901d1a7dd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\System\lRdjhUY.exe
  C:\Windows\System\lRdjhUY.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\ppfEcaE.exe
  C:\Windows\System\ppfEcaE.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\cPMRyCk.exe
  C:\Windows\System\cPMRyCk.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\llapIkO.exe
  C:\Windows\System\llapIkO.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\GSrfQie.exe
  C:\Windows\System\GSrfQie.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\WucPNQV.exe
  C:\Windows\System\WucPNQV.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ejJQGHN.exe
  C:\Windows\System\ejJQGHN.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ROgPziQ.exe
  C:\Windows\System\ROgPziQ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\cdYyYwJ.exe
  C:\Windows\System\cdYyYwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\zkXpnyU.exe
  C:\Windows\System\zkXpnyU.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\NFedEzF.exe
  C:\Windows\System\NFedEzF.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\SXVWWdk.exe
  C:\Windows\System\SXVWWdk.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\OZzscJw.exe
  C:\Windows\System\OZzscJw.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\UTbQMIH.exe
  C:\Windows\System\UTbQMIH.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\gPrOjCB.exe
  C:\Windows\System\gPrOjCB.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\FSeFgFA.exe
  C:\Windows\System\FSeFgFA.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\DBxhGAB.exe
  C:\Windows\System\DBxhGAB.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\wXshaNg.exe
  C:\Windows\System\wXshaNg.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\OELnFod.exe
  C:\Windows\System\OELnFod.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\CDfARot.exe
  C:\Windows\System\CDfARot.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\AXPBHeh.exe
  C:\Windows\System\AXPBHeh.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\fcBcuOU.exe
  C:\Windows\System\fcBcuOU.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\mqRzmSw.exe
  C:\Windows\System\mqRzmSw.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\UdkcaHE.exe
  C:\Windows\System\UdkcaHE.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\wVWscTw.exe
  C:\Windows\System\wVWscTw.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ZHCchBD.exe
  C:\Windows\System\ZHCchBD.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\DCFgPDu.exe
  C:\Windows\System\DCFgPDu.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\lvDlXpu.exe
  C:\Windows\System\lvDlXpu.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\baxzxks.exe
  C:\Windows\System\baxzxks.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\WaxESPA.exe
  C:\Windows\System\WaxESPA.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\CGOMKdf.exe
  C:\Windows\System\CGOMKdf.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\QldHmRa.exe
  C:\Windows\System\QldHmRa.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\GKNyBtZ.exe
  C:\Windows\System\GKNyBtZ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\boPLLpo.exe
  C:\Windows\System\boPLLpo.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\PmIqcFE.exe
  C:\Windows\System\PmIqcFE.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\YYBolCY.exe
  C:\Windows\System\YYBolCY.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\hbWDeEE.exe
  C:\Windows\System\hbWDeEE.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\xCrKKld.exe
  C:\Windows\System\xCrKKld.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\xpcfAWx.exe
  C:\Windows\System\xpcfAWx.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\BTshknK.exe
  C:\Windows\System\BTshknK.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\eRZbSvU.exe
  C:\Windows\System\eRZbSvU.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\veVnSkd.exe
  C:\Windows\System\veVnSkd.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\BLltnGU.exe
  C:\Windows\System\BLltnGU.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\bunagaV.exe
  C:\Windows\System\bunagaV.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\kLDAmKh.exe
  C:\Windows\System\kLDAmKh.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\SksgMrm.exe
  C:\Windows\System\SksgMrm.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\PJhZxxY.exe
  C:\Windows\System\PJhZxxY.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\xwKuZcB.exe
  C:\Windows\System\xwKuZcB.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\xoyvHVK.exe
  C:\Windows\System\xoyvHVK.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\MjboqGC.exe
  C:\Windows\System\MjboqGC.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\nxjqGnn.exe
  C:\Windows\System\nxjqGnn.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\vYImoIa.exe
  C:\Windows\System\vYImoIa.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\CgTvwvZ.exe
  C:\Windows\System\CgTvwvZ.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\rdshsDn.exe
  C:\Windows\System\rdshsDn.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\EGHNguh.exe
  C:\Windows\System\EGHNguh.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\BPySwXS.exe
  C:\Windows\System\BPySwXS.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\VUbWXRL.exe
  C:\Windows\System\VUbWXRL.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\TzjMxJG.exe
  C:\Windows\System\TzjMxJG.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\NTnVYZe.exe
  C:\Windows\System\NTnVYZe.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\nVaqbRL.exe
  C:\Windows\System\nVaqbRL.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\SNgWhBG.exe
  C:\Windows\System\SNgWhBG.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\IpGXOeJ.exe
  C:\Windows\System\IpGXOeJ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\amkhNpF.exe
  C:\Windows\System\amkhNpF.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\KvOXyju.exe
  C:\Windows\System\KvOXyju.exe
  2⤵
  PID:1960
- C:\Windows\System\CTnnFTi.exe
  C:\Windows\System\CTnnFTi.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\RBSbRzH.exe
  C:\Windows\System\RBSbRzH.exe
  2⤵
  PID:2684
- C:\Windows\System\oDCEmFb.exe
  C:\Windows\System\oDCEmFb.exe
  2⤵
  PID:536
- C:\Windows\System\OynNRul.exe
  C:\Windows\System\OynNRul.exe
  2⤵
  PID:1108
- C:\Windows\System\fxUtXFs.exe
  C:\Windows\System\fxUtXFs.exe
  2⤵
  PID:2784
- C:\Windows\System\PBxyNXQ.exe
  C:\Windows\System\PBxyNXQ.exe
  2⤵
  PID:2228
- C:\Windows\System\mCtLVKG.exe
  C:\Windows\System\mCtLVKG.exe
  2⤵
  PID:2552
- C:\Windows\System\DJxlaio.exe
  C:\Windows\System\DJxlaio.exe
  2⤵
  PID:2868
- C:\Windows\System\RVIjdYU.exe
  C:\Windows\System\RVIjdYU.exe
  2⤵
  PID:1652
- C:\Windows\System\jWTKlrO.exe
  C:\Windows\System\jWTKlrO.exe
  2⤵
  PID:1436
- C:\Windows\System\MpFTgpt.exe
  C:\Windows\System\MpFTgpt.exe
  2⤵
  PID:1700
- C:\Windows\System\BKSbAIB.exe
  C:\Windows\System\BKSbAIB.exe
  2⤵
  PID:1716
- C:\Windows\System\unhfpjp.exe
  C:\Windows\System\unhfpjp.exe
  2⤵
  PID:2524
- C:\Windows\System\lrxPMYF.exe
  C:\Windows\System\lrxPMYF.exe
  2⤵
  PID:692
- C:\Windows\System\fhDvdYE.exe
  C:\Windows\System\fhDvdYE.exe
  2⤵
  PID:1488
- C:\Windows\System\FkivUgm.exe
  C:\Windows\System\FkivUgm.exe
  2⤵
  PID:1328
- C:\Windows\System\ofSoNBz.exe
  C:\Windows\System\ofSoNBz.exe
  2⤵
  PID:1964
- C:\Windows\System\YPvBkjE.exe
  C:\Windows\System\YPvBkjE.exe
  2⤵
  PID:2404
- C:\Windows\System\RRTWhhy.exe
  C:\Windows\System\RRTWhhy.exe
  2⤵
  PID:1852
- C:\Windows\System\VSlNUfd.exe
  C:\Windows\System\VSlNUfd.exe
  2⤵
  PID:2860
- C:\Windows\System\VsOfSRd.exe
  C:\Windows\System\VsOfSRd.exe
  2⤵
  PID:2456
- C:\Windows\System\NMYlvon.exe
  C:\Windows\System\NMYlvon.exe
  2⤵
  PID:3012
- C:\Windows\System\milVWRt.exe
  C:\Windows\System\milVWRt.exe
  2⤵
  PID:2944
- C:\Windows\System\rakzCYM.exe
  C:\Windows\System\rakzCYM.exe
  2⤵
  PID:2052
- C:\Windows\System\TmGRBjU.exe
  C:\Windows\System\TmGRBjU.exe
  2⤵
  PID:576
- C:\Windows\System\HAKsJwv.exe
  C:\Windows\System\HAKsJwv.exe
  2⤵
  PID:1348
- C:\Windows\System\TSRLRQq.exe
  C:\Windows\System\TSRLRQq.exe
  2⤵
  PID:2036
- C:\Windows\System\hMoBbcX.exe
  C:\Windows\System\hMoBbcX.exe
  2⤵
  PID:2032
- C:\Windows\System\PYbvCvR.exe
  C:\Windows\System\PYbvCvR.exe
  2⤵
  PID:888
- C:\Windows\System\QbvDgyv.exe
  C:\Windows\System\QbvDgyv.exe
  2⤵
  PID:1764
- C:\Windows\System\QpAcMey.exe
  C:\Windows\System\QpAcMey.exe
  2⤵
  PID:972
- C:\Windows\System\fdEFGcU.exe
  C:\Windows\System\fdEFGcU.exe
  2⤵
  PID:1620
- C:\Windows\System\hSTlrfN.exe
  C:\Windows\System\hSTlrfN.exe
  2⤵
  PID:2716
- C:\Windows\System\lVjmfWG.exe
  C:\Windows\System\lVjmfWG.exe
  2⤵
  PID:1628
- C:\Windows\System\NKLKsUa.exe
  C:\Windows\System\NKLKsUa.exe
  2⤵
  PID:2852
- C:\Windows\System\CsXUcAw.exe
  C:\Windows\System\CsXUcAw.exe
  2⤵
  PID:2180
- C:\Windows\System\gAmfbeO.exe
  C:\Windows\System\gAmfbeO.exe
  2⤵
  PID:2736
- C:\Windows\System\AwowAcV.exe
  C:\Windows\System\AwowAcV.exe
  2⤵
  PID:2432
- C:\Windows\System\ksObwXt.exe
  C:\Windows\System\ksObwXt.exe
  2⤵
  PID:1456
- C:\Windows\System\bCqPPsk.exe
  C:\Windows\System\bCqPPsk.exe
  2⤵
  PID:2244
- C:\Windows\System\cpXFHEm.exe
  C:\Windows\System\cpXFHEm.exe
  2⤵
  PID:444
- C:\Windows\System\wOUWOEH.exe
  C:\Windows\System\wOUWOEH.exe
  2⤵
  PID:2284
- C:\Windows\System\ldIgojg.exe
  C:\Windows\System\ldIgojg.exe
  2⤵
  PID:2516
- C:\Windows\System\JBOowmp.exe
  C:\Windows\System\JBOowmp.exe
  2⤵
  PID:2972
- C:\Windows\System\ayyLnck.exe
  C:\Windows\System\ayyLnck.exe
  2⤵
  PID:796
- C:\Windows\System\fhkldok.exe
  C:\Windows\System\fhkldok.exe
  2⤵
  PID:2088
- C:\Windows\System\vGJlWLl.exe
  C:\Windows\System\vGJlWLl.exe
  2⤵
  PID:1532
- C:\Windows\System\hLiCXRr.exe
  C:\Windows\System\hLiCXRr.exe
  2⤵
  PID:2380
- C:\Windows\System\LQzoZmx.exe
  C:\Windows\System\LQzoZmx.exe
  2⤵
  PID:672
- C:\Windows\System\yPfonNT.exe
  C:\Windows\System\yPfonNT.exe
  2⤵
  PID:1360
- C:\Windows\System\stbQCSv.exe
  C:\Windows\System\stbQCSv.exe
  2⤵
  PID:812
- C:\Windows\System\MmWWqfA.exe
  C:\Windows\System\MmWWqfA.exe
  2⤵
  PID:1828
- C:\Windows\System\wrJIxxy.exe
  C:\Windows\System\wrJIxxy.exe
  2⤵
  PID:2420
- C:\Windows\System\vvExXtL.exe
  C:\Windows\System\vvExXtL.exe
  2⤵
  PID:2808
- C:\Windows\System\MmxElWV.exe
  C:\Windows\System\MmxElWV.exe
  2⤵
  PID:2472
- C:\Windows\System\gMoxkiF.exe
  C:\Windows\System\gMoxkiF.exe
  2⤵
  PID:1592
- C:\Windows\System\rqKwOuC.exe
  C:\Windows\System\rqKwOuC.exe
  2⤵
  PID:2224
- C:\Windows\System\OfayTaa.exe
  C:\Windows\System\OfayTaa.exe
  2⤵
  PID:1572
- C:\Windows\System\qJfbDsj.exe
  C:\Windows\System\qJfbDsj.exe
  2⤵
  PID:1872
- C:\Windows\System\nepXgWk.exe
  C:\Windows\System\nepXgWk.exe
  2⤵
  PID:1148
- C:\Windows\System\trGGaMR.exe
  C:\Windows\System\trGGaMR.exe
  2⤵
  PID:2448
- C:\Windows\System\KTdvMrP.exe
  C:\Windows\System\KTdvMrP.exe
  2⤵
  PID:1944
- C:\Windows\System\SPjgzpt.exe
  C:\Windows\System\SPjgzpt.exe
  2⤵
  PID:2028
- C:\Windows\System\egMCYgw.exe
  C:\Windows\System\egMCYgw.exe
  2⤵
  PID:1792
- C:\Windows\System\qxtpylL.exe
  C:\Windows\System\qxtpylL.exe
  2⤵
  PID:1640
- C:\Windows\System\SpLWyhj.exe
  C:\Windows\System\SpLWyhj.exe
  2⤵
  PID:1200
- C:\Windows\System\GzGcrMP.exe
  C:\Windows\System\GzGcrMP.exe
  2⤵
  PID:2096
- C:\Windows\System\ytxQLLe.exe
  C:\Windows\System\ytxQLLe.exe
  2⤵
  PID:2804
- C:\Windows\System\HfvkKhq.exe
  C:\Windows\System\HfvkKhq.exe
  2⤵
  PID:772
- C:\Windows\System\wJZgviF.exe
  C:\Windows\System\wJZgviF.exe
  2⤵
  PID:2132
- C:\Windows\System\VFtnadO.exe
  C:\Windows\System\VFtnadO.exe
  2⤵
  PID:2816
- C:\Windows\System\IbojmIB.exe
  C:\Windows\System\IbojmIB.exe
  2⤵
  PID:1688
- C:\Windows\System\WJBduvd.exe
  C:\Windows\System\WJBduvd.exe
  2⤵
  PID:1780
- C:\Windows\System\pYlDbpt.exe
  C:\Windows\System\pYlDbpt.exe
  2⤵
  PID:496
- C:\Windows\System\IhkYvFh.exe
  C:\Windows\System\IhkYvFh.exe
  2⤵
  PID:2980
- C:\Windows\System\cSjmRmk.exe
  C:\Windows\System\cSjmRmk.exe
  2⤵
  PID:1516
- C:\Windows\System\yxZDtCq.exe
  C:\Windows\System\yxZDtCq.exe
  2⤵
  PID:2216
- C:\Windows\System\eMLBiva.exe
  C:\Windows\System\eMLBiva.exe
  2⤵
  PID:660
- C:\Windows\System\IEPHFGu.exe
  C:\Windows\System\IEPHFGu.exe
  2⤵
  PID:2068
- C:\Windows\System\WZqFgvd.exe
  C:\Windows\System\WZqFgvd.exe
  2⤵
  PID:1484
- C:\Windows\System\YyUgTCM.exe
  C:\Windows\System\YyUgTCM.exe
  2⤵
  PID:1044
- C:\Windows\System\OakxBKg.exe
  C:\Windows\System\OakxBKg.exe
  2⤵
  PID:3004
- C:\Windows\System\RVVksoc.exe
  C:\Windows\System\RVVksoc.exe
  2⤵
  PID:2364
- C:\Windows\System\jDUshOj.exe
  C:\Windows\System\jDUshOj.exe
  2⤵
  PID:2424
- C:\Windows\System\scwStaO.exe
  C:\Windows\System\scwStaO.exe
  2⤵
  PID:1324
- C:\Windows\System\mowNxdQ.exe
  C:\Windows\System\mowNxdQ.exe
  2⤵
  PID:1648
- C:\Windows\System\WbVFNrB.exe
  C:\Windows\System\WbVFNrB.exe
  2⤵
  PID:1264
- C:\Windows\System\kzHaDvF.exe
  C:\Windows\System\kzHaDvF.exe
  2⤵
  PID:852
- C:\Windows\System\NovfEii.exe
  C:\Windows\System\NovfEii.exe
  2⤵
  PID:2960
- C:\Windows\System\qdtHYcr.exe
  C:\Windows\System\qdtHYcr.exe
  2⤵
  PID:3172
- C:\Windows\System\lCczuhT.exe
  C:\Windows\System\lCczuhT.exe
  2⤵
  PID:3188
- C:\Windows\System\xZdkhyn.exe
  C:\Windows\System\xZdkhyn.exe
  2⤵
  PID:3204
- C:\Windows\System\oZbrAgr.exe
  C:\Windows\System\oZbrAgr.exe
  2⤵
  PID:3220
- C:\Windows\System\KNlgHxt.exe
  C:\Windows\System\KNlgHxt.exe
  2⤵
  PID:3236
- C:\Windows\System\KAMaYyE.exe
  C:\Windows\System\KAMaYyE.exe
  2⤵
  PID:3252
- C:\Windows\System\frSjOwO.exe
  C:\Windows\System\frSjOwO.exe
  2⤵
  PID:3268
- C:\Windows\System\HsJybpH.exe
  C:\Windows\System\HsJybpH.exe
  2⤵
  PID:3284
- C:\Windows\System\dwudUQc.exe
  C:\Windows\System\dwudUQc.exe
  2⤵
  PID:3300
- C:\Windows\System\uFIZJwU.exe
  C:\Windows\System\uFIZJwU.exe
  2⤵
  PID:3316
- C:\Windows\System\EJdlBRi.exe
  C:\Windows\System\EJdlBRi.exe
  2⤵
  PID:3332
- C:\Windows\System\oIdQook.exe
  C:\Windows\System\oIdQook.exe
  2⤵
  PID:3348
- C:\Windows\System\zOdIZKo.exe
  C:\Windows\System\zOdIZKo.exe
  2⤵
  PID:3364
- C:\Windows\System\XgEUynQ.exe
  C:\Windows\System\XgEUynQ.exe
  2⤵
  PID:3380
- C:\Windows\System\OPPlWyv.exe
  C:\Windows\System\OPPlWyv.exe
  2⤵
  PID:3400
- C:\Windows\System\lieRKVn.exe
  C:\Windows\System\lieRKVn.exe
  2⤵
  PID:3416
- C:\Windows\System\XgltRQW.exe
  C:\Windows\System\XgltRQW.exe
  2⤵
  PID:3432
- C:\Windows\System\ePCDZps.exe
  C:\Windows\System\ePCDZps.exe
  2⤵
  PID:3448
- C:\Windows\System\sOaQdCc.exe
  C:\Windows\System\sOaQdCc.exe
  2⤵
  PID:3464
- C:\Windows\System\qLXavgI.exe
  C:\Windows\System\qLXavgI.exe
  2⤵
  PID:3480
- C:\Windows\System\wPxjHsQ.exe
  C:\Windows\System\wPxjHsQ.exe
  2⤵
  PID:3496
- C:\Windows\System\CIlwxwE.exe
  C:\Windows\System\CIlwxwE.exe
  2⤵
  PID:3512
- C:\Windows\System\LFZNNbP.exe
  C:\Windows\System\LFZNNbP.exe
  2⤵
  PID:3528
- C:\Windows\System\qicsBeD.exe
  C:\Windows\System\qicsBeD.exe
  2⤵
  PID:3544
- C:\Windows\System\jVlodRi.exe
  C:\Windows\System\jVlodRi.exe
  2⤵
  PID:3560
- C:\Windows\System\XBreNVP.exe
  C:\Windows\System\XBreNVP.exe
  2⤵
  PID:3576
- C:\Windows\System\wCtFpAY.exe
  C:\Windows\System\wCtFpAY.exe
  2⤵
  PID:3592
- C:\Windows\System\kcTcawn.exe
  C:\Windows\System\kcTcawn.exe
  2⤵
  PID:3608
- C:\Windows\System\pKkMcKq.exe
  C:\Windows\System\pKkMcKq.exe
  2⤵
  PID:3624
- C:\Windows\System\UMbhIKx.exe
  C:\Windows\System\UMbhIKx.exe
  2⤵
  PID:3640
- C:\Windows\System\vUAkAZg.exe
  C:\Windows\System\vUAkAZg.exe
  2⤵
  PID:3656
- C:\Windows\System\NENTiqD.exe
  C:\Windows\System\NENTiqD.exe
  2⤵
  PID:3672
- C:\Windows\System\WlVbIiS.exe
  C:\Windows\System\WlVbIiS.exe
  2⤵
  PID:3688
- C:\Windows\System\QCVsWME.exe
  C:\Windows\System\QCVsWME.exe
  2⤵
  PID:3704
- C:\Windows\System\KMZfaBv.exe
  C:\Windows\System\KMZfaBv.exe
  2⤵
  PID:3720
- C:\Windows\System\pXAavxJ.exe
  C:\Windows\System\pXAavxJ.exe
  2⤵
  PID:3736
- C:\Windows\System\oGOtwEg.exe
  C:\Windows\System\oGOtwEg.exe
  2⤵
  PID:3752
- C:\Windows\System\VhbudJM.exe
  C:\Windows\System\VhbudJM.exe
  2⤵
  PID:3768
- C:\Windows\System\DsVaieS.exe
  C:\Windows\System\DsVaieS.exe
  2⤵
  PID:3784
- C:\Windows\System\bZIdMWa.exe
  C:\Windows\System\bZIdMWa.exe
  2⤵
  PID:3800
- C:\Windows\System\sZABmYk.exe
  C:\Windows\System\sZABmYk.exe
  2⤵
  PID:3816
- C:\Windows\System\ZNFbqxj.exe
  C:\Windows\System\ZNFbqxj.exe
  2⤵
  PID:3832
- C:\Windows\System\qlvxGUF.exe
  C:\Windows\System\qlvxGUF.exe
  2⤵
  PID:3848
- C:\Windows\System\wJZfEbw.exe
  C:\Windows\System\wJZfEbw.exe
  2⤵
  PID:3864
- C:\Windows\System\ZPXTeIN.exe
  C:\Windows\System\ZPXTeIN.exe
  2⤵
  PID:3880
- C:\Windows\System\nWNeEOg.exe
  C:\Windows\System\nWNeEOg.exe
  2⤵
  PID:3896
- C:\Windows\System\yIWdViu.exe
  C:\Windows\System\yIWdViu.exe
  2⤵
  PID:3912
- C:\Windows\System\fvKyaZJ.exe
  C:\Windows\System\fvKyaZJ.exe
  2⤵
  PID:3932
- C:\Windows\System\pgBAIZs.exe
  C:\Windows\System\pgBAIZs.exe
  2⤵
  PID:3948
- C:\Windows\System\eVtdWVK.exe
  C:\Windows\System\eVtdWVK.exe
  2⤵
  PID:3964
- C:\Windows\System\SXhTrXt.exe
  C:\Windows\System\SXhTrXt.exe
  2⤵
  PID:3984
- C:\Windows\System\ZXcGVqU.exe
  C:\Windows\System\ZXcGVqU.exe
  2⤵
  PID:4004
- C:\Windows\System\iWWYtJy.exe
  C:\Windows\System\iWWYtJy.exe
  2⤵
  PID:4020
- C:\Windows\System\OJsdKKT.exe
  C:\Windows\System\OJsdKKT.exe
  2⤵
  PID:4040
- C:\Windows\System\YcbfgYl.exe
  C:\Windows\System\YcbfgYl.exe
  2⤵
  PID:4056
- C:\Windows\System\MLqDmOT.exe
  C:\Windows\System\MLqDmOT.exe
  2⤵
  PID:4076
- C:\Windows\System\JUPxCuh.exe
  C:\Windows\System\JUPxCuh.exe
  2⤵
  PID:4092
- C:\Windows\System\PVtjPkf.exe
  C:\Windows\System\PVtjPkf.exe
  2⤵
  PID:1596
- C:\Windows\System\VZLpXHp.exe
  C:\Windows\System\VZLpXHp.exe
  2⤵
  PID:1168
- C:\Windows\System\QjdgrbY.exe
  C:\Windows\System\QjdgrbY.exe
  2⤵
  PID:292
- C:\Windows\System\yeFbcmM.exe
  C:\Windows\System\yeFbcmM.exe
  2⤵
  PID:1536
- C:\Windows\System\lBxkgcQ.exe
  C:\Windows\System\lBxkgcQ.exe
  2⤵
  PID:3080
- C:\Windows\System\SrMeinW.exe
  C:\Windows\System\SrMeinW.exe
  2⤵
  PID:3104
- C:\Windows\System\rfIQdsa.exe
  C:\Windows\System\rfIQdsa.exe
  2⤵
  PID:3148
- C:\Windows\System\whaqUCE.exe
  C:\Windows\System\whaqUCE.exe
  2⤵
  PID:484
- C:\Windows\System\cleaWIZ.exe
  C:\Windows\System\cleaWIZ.exe
  2⤵
  PID:1624
- C:\Windows\System\kHowEbu.exe
  C:\Windows\System\kHowEbu.exe
  2⤵
  PID:3248
- C:\Windows\System\vpVEVdt.exe
  C:\Windows\System\vpVEVdt.exe
  2⤵
  PID:3324
- C:\Windows\System\bREnfrF.exe
  C:\Windows\System\bREnfrF.exe
  2⤵
  PID:3356
- C:\Windows\System\vVcGaqk.exe
  C:\Windows\System\vVcGaqk.exe
  2⤵
  PID:3428
- C:\Windows\System\RBOxhRJ.exe
  C:\Windows\System\RBOxhRJ.exe
  2⤵
  PID:3460
- C:\Windows\System\VCgtwpM.exe
  C:\Windows\System\VCgtwpM.exe
  2⤵
  PID:3492
- C:\Windows\System\zzoRAov.exe
  C:\Windows\System\zzoRAov.exe
  2⤵
  PID:3552
- C:\Windows\System\oLtZUSG.exe
  C:\Windows\System\oLtZUSG.exe
  2⤵
  PID:3584
- C:\Windows\System\SHjBbZH.exe
  C:\Windows\System\SHjBbZH.exe
  2⤵
  PID:3616
- C:\Windows\System\aDagwMv.exe
  C:\Windows\System\aDagwMv.exe
  2⤵
  PID:3632
- C:\Windows\System\KKrDDHN.exe
  C:\Windows\System\KKrDDHN.exe
  2⤵
  PID:3696
- C:\Windows\System\OCbgpeN.exe
  C:\Windows\System\OCbgpeN.exe
  2⤵
  PID:3744
- C:\Windows\System\fgKzJdj.exe
  C:\Windows\System\fgKzJdj.exe
  2⤵
  PID:3808
- C:\Windows\System\ecdbOxu.exe
  C:\Windows\System\ecdbOxu.exe
  2⤵
  PID:3728
- C:\Windows\System\kOpBQKC.exe
  C:\Windows\System\kOpBQKC.exe
  2⤵
  PID:3792
- C:\Windows\System\gvmSNdN.exe
  C:\Windows\System\gvmSNdN.exe
  2⤵
  PID:3872
- C:\Windows\System\WvumoNF.exe
  C:\Windows\System\WvumoNF.exe
  2⤵
  PID:3856
- C:\Windows\System\DAsqzhU.exe
  C:\Windows\System\DAsqzhU.exe
  2⤵
  PID:3920
- C:\Windows\System\wGGgDob.exe
  C:\Windows\System\wGGgDob.exe
  2⤵
  PID:3972
- C:\Windows\System\SfONJMG.exe
  C:\Windows\System\SfONJMG.exe
  2⤵
  PID:3924
- C:\Windows\System\SzKdXuD.exe
  C:\Windows\System\SzKdXuD.exe
  2⤵
  PID:4084
- C:\Windows\System\clXZvpL.exe
  C:\Windows\System\clXZvpL.exe
  2⤵
  PID:4032
- C:\Windows\System\VKeUatx.exe
  C:\Windows\System\VKeUatx.exe
  2⤵
  PID:584
- C:\Windows\System\UwJpfdw.exe
  C:\Windows\System\UwJpfdw.exe
  2⤵
  PID:4028
- C:\Windows\System\nGVVyRS.exe
  C:\Windows\System\nGVVyRS.exe
  2⤵
  PID:3100
- C:\Windows\System\hBuVaUR.exe
  C:\Windows\System\hBuVaUR.exe
  2⤵
  PID:4068
- C:\Windows\System\QPpBmaz.exe
  C:\Windows\System\QPpBmaz.exe
  2⤵
  PID:2680
- C:\Windows\System\bmbhFJz.exe
  C:\Windows\System\bmbhFJz.exe
  2⤵
  PID:3140
- C:\Windows\System\lwTLgiw.exe
  C:\Windows\System\lwTLgiw.exe
  2⤵
  PID:3160
- C:\Windows\System\fUQtrib.exe
  C:\Windows\System\fUQtrib.exe
  2⤵
  PID:3120
- C:\Windows\System\UzxoueH.exe
  C:\Windows\System\UzxoueH.exe
  2⤵
  PID:3144
- C:\Windows\System\ATuZcWr.exe
  C:\Windows\System\ATuZcWr.exe
  2⤵
  PID:3260
- C:\Windows\System\BvGonQE.exe
  C:\Windows\System\BvGonQE.exe
  2⤵
  PID:3200
- C:\Windows\System\GiYLgXS.exe
  C:\Windows\System\GiYLgXS.exe
  2⤵
  PID:1632
- C:\Windows\System\FuLpBnw.exe
  C:\Windows\System\FuLpBnw.exe
  2⤵
  PID:1808
- C:\Windows\System\gUjhmoO.exe
  C:\Windows\System\gUjhmoO.exe
  2⤵
  PID:3340
- C:\Windows\System\qHVGbCp.exe
  C:\Windows\System\qHVGbCp.exe
  2⤵
  PID:3440
- C:\Windows\System\KaHfQis.exe
  C:\Windows\System\KaHfQis.exe
  2⤵
  PID:3572
- C:\Windows\System\JLWQGsC.exe
  C:\Windows\System\JLWQGsC.exe
  2⤵
  PID:1784
- C:\Windows\System\uTvLGfU.exe
  C:\Windows\System\uTvLGfU.exe
  2⤵
  PID:3476
- C:\Windows\System\BBOnYoI.exe
  C:\Windows\System\BBOnYoI.exe
  2⤵
  PID:3620
- C:\Windows\System\yNFFWlc.exe
  C:\Windows\System\yNFFWlc.exe
  2⤵
  PID:3392
- C:\Windows\System\dlporZA.exe
  C:\Windows\System\dlporZA.exe
  2⤵
  PID:1644
- C:\Windows\System\qQnzkvB.exe
  C:\Windows\System\qQnzkvB.exe
  2⤵
  PID:3780
- C:\Windows\System\CsWzvKE.exe
  C:\Windows\System\CsWzvKE.exe
  2⤵
  PID:3904
- C:\Windows\System\sWAKLXs.exe
  C:\Windows\System\sWAKLXs.exe
  2⤵
  PID:4016
- C:\Windows\System\bXBWxJY.exe
  C:\Windows\System\bXBWxJY.exe
  2⤵
  PID:2604
- C:\Windows\System\VTtOwzf.exe
  C:\Windows\System\VTtOwzf.exe
  2⤵
  PID:1256
- C:\Windows\System\DBoqjjK.exe
  C:\Windows\System\DBoqjjK.exe
  2⤵
  PID:3132
- C:\Windows\System\hrWmpfP.exe
  C:\Windows\System\hrWmpfP.exe
  2⤵
  PID:3196
- C:\Windows\System\KFtKOWo.exe
  C:\Windows\System\KFtKOWo.exe
  2⤵
  PID:1248
- C:\Windows\System\DTdspqi.exe
  C:\Windows\System\DTdspqi.exe
  2⤵
  PID:3604
- C:\Windows\System\ozoZPKp.exe
  C:\Windows\System\ozoZPKp.exe
  2⤵
  PID:3764
- C:\Windows\System\MEkrCpg.exe
  C:\Windows\System\MEkrCpg.exe
  2⤵
  PID:4052
- C:\Windows\System\GhKljnT.exe
  C:\Windows\System\GhKljnT.exe
  2⤵
  PID:3992
- C:\Windows\System\OTZVGNq.exe
  C:\Windows\System\OTZVGNq.exe
  2⤵
  PID:1080
- C:\Windows\System\yVzQmgl.exe
  C:\Windows\System\yVzQmgl.exe
  2⤵
  PID:3124
- C:\Windows\System\GCczxWL.exe
  C:\Windows\System\GCczxWL.exe
  2⤵
  PID:3244
- C:\Windows\System\mpWfGGO.exe
  C:\Windows\System\mpWfGGO.exe
  2⤵
  PID:2744
- C:\Windows\System\tMPQOYu.exe
  C:\Windows\System\tMPQOYu.exe
  2⤵
  PID:3524
- C:\Windows\System\qCgZGkw.exe
  C:\Windows\System\qCgZGkw.exe
  2⤵
  PID:3636
- C:\Windows\System\MzOqIhi.exe
  C:\Windows\System\MzOqIhi.exe
  2⤵
  PID:3156
- C:\Windows\System\mhyWGFJ.exe
  C:\Windows\System\mhyWGFJ.exe
  2⤵
  PID:3668
- C:\Windows\System\FbOlCAE.exe
  C:\Windows\System\FbOlCAE.exe
  2⤵
  PID:3840
- C:\Windows\System\SrHnBLL.exe
  C:\Windows\System\SrHnBLL.exe
  2⤵
  PID:3892
- C:\Windows\System\vUvUCgc.exe
  C:\Windows\System\vUvUCgc.exe
  2⤵
  PID:2780
- C:\Windows\System\YivstwY.exe
  C:\Windows\System\YivstwY.exe
  2⤵
  PID:3092
- C:\Windows\System\UXpBdgb.exe
  C:\Windows\System\UXpBdgb.exe
  2⤵
  PID:1528
- C:\Windows\System\xSJzgrQ.exe
  C:\Windows\System\xSJzgrQ.exe
  2⤵
  PID:2788
- C:\Windows\System\nikSzVf.exe
  C:\Windows\System\nikSzVf.exe
  2⤵
  PID:3976
- C:\Windows\System\Glkobwv.exe
  C:\Windows\System\Glkobwv.exe
  2⤵
  PID:2572
- C:\Windows\System\AkcdcEO.exe
  C:\Windows\System\AkcdcEO.exe
  2⤵
  PID:3308
- C:\Windows\System\knenfgf.exe
  C:\Windows\System\knenfgf.exe
  2⤵
  PID:2608
- C:\Windows\System\xlWlMFj.exe
  C:\Windows\System\xlWlMFj.exe
  2⤵
  PID:2636
- C:\Windows\System\wLNcLIl.exe
  C:\Windows\System\wLNcLIl.exe
  2⤵
  PID:3408
- C:\Windows\System\oILyqgN.exe
  C:\Windows\System\oILyqgN.exe
  2⤵
  PID:3680
- C:\Windows\System\eUrmDaL.exe
  C:\Windows\System\eUrmDaL.exe
  2⤵
  PID:3700
- C:\Windows\System\qMhLkgE.exe
  C:\Windows\System\qMhLkgE.exe
  2⤵
  PID:4108
- C:\Windows\System\ibQETVP.exe
  C:\Windows\System\ibQETVP.exe
  2⤵
  PID:4124
- C:\Windows\System\MTByllb.exe
  C:\Windows\System\MTByllb.exe
  2⤵
  PID:4140
- C:\Windows\System\PWLvYvN.exe
  C:\Windows\System\PWLvYvN.exe
  2⤵
  PID:4156
- C:\Windows\System\WwjBbOV.exe
  C:\Windows\System\WwjBbOV.exe
  2⤵
  PID:4172
- C:\Windows\System\giritjN.exe
  C:\Windows\System\giritjN.exe
  2⤵
  PID:4188
- C:\Windows\System\MnQEzwH.exe
  C:\Windows\System\MnQEzwH.exe
  2⤵
  PID:4204
- C:\Windows\System\nXGGYyj.exe
  C:\Windows\System\nXGGYyj.exe
  2⤵
  PID:4220
- C:\Windows\System\JUuBScC.exe
  C:\Windows\System\JUuBScC.exe
  2⤵
  PID:4236
- C:\Windows\System\YvCcSjh.exe
  C:\Windows\System\YvCcSjh.exe
  2⤵
  PID:4260
- C:\Windows\System\qmJMurx.exe
  C:\Windows\System\qmJMurx.exe
  2⤵
  PID:4280
- C:\Windows\System\eAxrodE.exe
  C:\Windows\System\eAxrodE.exe
  2⤵
  PID:4296
- C:\Windows\System\MltKKJc.exe
  C:\Windows\System\MltKKJc.exe
  2⤵
  PID:4312
- C:\Windows\System\KQCgKly.exe
  C:\Windows\System\KQCgKly.exe
  2⤵
  PID:4328
- C:\Windows\System\iWqaLbg.exe
  C:\Windows\System\iWqaLbg.exe
  2⤵
  PID:4344
- C:\Windows\System\vnUrXDc.exe
  C:\Windows\System\vnUrXDc.exe
  2⤵
  PID:4360
- C:\Windows\System\ANlUrEy.exe
  C:\Windows\System\ANlUrEy.exe
  2⤵
  PID:4376
- C:\Windows\System\DDlWijR.exe
  C:\Windows\System\DDlWijR.exe
  2⤵
  PID:4392
- C:\Windows\System\OumTukd.exe
  C:\Windows\System\OumTukd.exe
  2⤵
  PID:4408
- C:\Windows\System\TzjQxWh.exe
  C:\Windows\System\TzjQxWh.exe
  2⤵
  PID:4424
- C:\Windows\System\aFGUlif.exe
  C:\Windows\System\aFGUlif.exe
  2⤵
  PID:4440
- C:\Windows\System\ezFrMxe.exe
  C:\Windows\System\ezFrMxe.exe
  2⤵
  PID:4456
- C:\Windows\System\LRwiYaW.exe
  C:\Windows\System\LRwiYaW.exe
  2⤵
  PID:4472
- C:\Windows\System\ONcfEKN.exe
  C:\Windows\System\ONcfEKN.exe
  2⤵
  PID:4488
- C:\Windows\System\OcbLqGd.exe
  C:\Windows\System\OcbLqGd.exe
  2⤵
  PID:4504
- C:\Windows\System\jAIINdT.exe
  C:\Windows\System\jAIINdT.exe
  2⤵
  PID:4520
- C:\Windows\System\pPjCJGi.exe
  C:\Windows\System\pPjCJGi.exe
  2⤵
  PID:4536
- C:\Windows\System\lzZoPft.exe
  C:\Windows\System\lzZoPft.exe
  2⤵
  PID:4552
- C:\Windows\System\PFRAcBQ.exe
  C:\Windows\System\PFRAcBQ.exe
  2⤵
  PID:4568
- C:\Windows\System\BBngCpB.exe
  C:\Windows\System\BBngCpB.exe
  2⤵
  PID:4584
- C:\Windows\System\TvcimGo.exe
  C:\Windows\System\TvcimGo.exe
  2⤵
  PID:4600
- C:\Windows\System\bQBCpzT.exe
  C:\Windows\System\bQBCpzT.exe
  2⤵
  PID:4616
- C:\Windows\System\cWCTybp.exe
  C:\Windows\System\cWCTybp.exe
  2⤵
  PID:4632
- C:\Windows\System\GCLUWXN.exe
  C:\Windows\System\GCLUWXN.exe
  2⤵
  PID:4648
- C:\Windows\System\uMfMOGR.exe
  C:\Windows\System\uMfMOGR.exe
  2⤵
  PID:4664
- C:\Windows\System\xRLMcXt.exe
  C:\Windows\System\xRLMcXt.exe
  2⤵
  PID:4680
- C:\Windows\System\HCmpMaq.exe
  C:\Windows\System\HCmpMaq.exe
  2⤵
  PID:4696
- C:\Windows\System\euZNwyV.exe
  C:\Windows\System\euZNwyV.exe
  2⤵
  PID:4712
- C:\Windows\System\XpYyipc.exe
  C:\Windows\System\XpYyipc.exe
  2⤵
  PID:4728
- C:\Windows\System\ayHrSUi.exe
  C:\Windows\System\ayHrSUi.exe
  2⤵
  PID:4744
- C:\Windows\System\PiXaUTd.exe
  C:\Windows\System\PiXaUTd.exe
  2⤵
  PID:4760
- C:\Windows\System\YZHWzaB.exe
  C:\Windows\System\YZHWzaB.exe
  2⤵
  PID:4776
- C:\Windows\System\XQegUnS.exe
  C:\Windows\System\XQegUnS.exe
  2⤵
  PID:4792
- C:\Windows\System\zhMGsvn.exe
  C:\Windows\System\zhMGsvn.exe
  2⤵
  PID:4808
- C:\Windows\System\KHySziq.exe
  C:\Windows\System\KHySziq.exe
  2⤵
  PID:4824
- C:\Windows\System\aVrRttH.exe
  C:\Windows\System\aVrRttH.exe
  2⤵
  PID:4840
- C:\Windows\System\fkpLJEa.exe
  C:\Windows\System\fkpLJEa.exe
  2⤵
  PID:4856
- C:\Windows\System\EZHcRnj.exe
  C:\Windows\System\EZHcRnj.exe
  2⤵
  PID:4872
- C:\Windows\System\ZlFfglY.exe
  C:\Windows\System\ZlFfglY.exe
  2⤵
  PID:4888
- C:\Windows\System\TzVFFRb.exe
  C:\Windows\System\TzVFFRb.exe
  2⤵
  PID:4904
- C:\Windows\System\jsBtmJf.exe
  C:\Windows\System\jsBtmJf.exe
  2⤵
  PID:4920
- C:\Windows\System\xrmEcTG.exe
  C:\Windows\System\xrmEcTG.exe
  2⤵
  PID:4936
- C:\Windows\System\ZKbpyDX.exe
  C:\Windows\System\ZKbpyDX.exe
  2⤵
  PID:4952
- C:\Windows\System\RnvbpYS.exe
  C:\Windows\System\RnvbpYS.exe
  2⤵
  PID:4968
- C:\Windows\System\daeFOWI.exe
  C:\Windows\System\daeFOWI.exe
  2⤵
  PID:4984
- C:\Windows\System\CyvlXyg.exe
  C:\Windows\System\CyvlXyg.exe
  2⤵
  PID:5000
- C:\Windows\System\cmVOIMF.exe
  C:\Windows\System\cmVOIMF.exe
  2⤵
  PID:5016
- C:\Windows\System\naiPXST.exe
  C:\Windows\System\naiPXST.exe
  2⤵
  PID:5032
- C:\Windows\System\twlcbcK.exe
  C:\Windows\System\twlcbcK.exe
  2⤵
  PID:5048
- C:\Windows\System\xburtLF.exe
  C:\Windows\System\xburtLF.exe
  2⤵
  PID:5064
- C:\Windows\System\WKlmTvP.exe
  C:\Windows\System\WKlmTvP.exe
  2⤵
  PID:5080
- C:\Windows\System\uKYKEXQ.exe
  C:\Windows\System\uKYKEXQ.exe
  2⤵
  PID:5096
- C:\Windows\System\JjLmUtI.exe
  C:\Windows\System\JjLmUtI.exe
  2⤵
  PID:5112
- C:\Windows\System\eXMsxLI.exe
  C:\Windows\System\eXMsxLI.exe
  2⤵
  PID:2632
- C:\Windows\System\apqFIat.exe
  C:\Windows\System\apqFIat.exe
  2⤵
  PID:1876
- C:\Windows\System\yfpweJg.exe
  C:\Windows\System\yfpweJg.exe
  2⤵
  PID:4152
- C:\Windows\System\qGPpxWR.exe
  C:\Windows\System\qGPpxWR.exe
  2⤵
  PID:3928
- C:\Windows\System\AGVdikb.exe
  C:\Windows\System\AGVdikb.exe
  2⤵
  PID:4100
- C:\Windows\System\jrIFSJS.exe
  C:\Windows\System\jrIFSJS.exe
  2⤵
  PID:3232
- C:\Windows\System\XzhjgQp.exe
  C:\Windows\System\XzhjgQp.exe
  2⤵
  PID:4164
- C:\Windows\System\LNzBKea.exe
  C:\Windows\System\LNzBKea.exe
  2⤵
  PID:4228
- C:\Windows\System\efceYEQ.exe
  C:\Windows\System\efceYEQ.exe
  2⤵
  PID:4244
- C:\Windows\System\KpdTzJI.exe
  C:\Windows\System\KpdTzJI.exe
  2⤵
  PID:4288
- C:\Windows\System\GfYpGSp.exe
  C:\Windows\System\GfYpGSp.exe
  2⤵
  PID:4324
- C:\Windows\System\VXAzQWD.exe
  C:\Windows\System\VXAzQWD.exe
  2⤵
  PID:4388
- C:\Windows\System\hzagMts.exe
  C:\Windows\System\hzagMts.exe
  2⤵
  PID:4452
- C:\Windows\System\kkCnVUP.exe
  C:\Windows\System\kkCnVUP.exe
  2⤵
  PID:4404
- C:\Windows\System\wWVuUMx.exe
  C:\Windows\System\wWVuUMx.exe
  2⤵
  PID:4516
- C:\Windows\System\RDXWbsP.exe
  C:\Windows\System\RDXWbsP.exe
  2⤵
  PID:4272
- C:\Windows\System\EVUiuWN.exe
  C:\Windows\System\EVUiuWN.exe
  2⤵
  PID:4548
- C:\Windows\System\lbieAaD.exe
  C:\Windows\System\lbieAaD.exe
  2⤵
  PID:4340
- C:\Windows\System\tbywfFD.exe
  C:\Windows\System\tbywfFD.exe
  2⤵
  PID:4612
- C:\Windows\System\BhYAzQt.exe
  C:\Windows\System\BhYAzQt.exe
  2⤵
  PID:4500
- C:\Windows\System\qsRmoSU.exe
  C:\Windows\System\qsRmoSU.exe
  2⤵
  PID:4528
- C:\Windows\System\jzAQNvo.exe
  C:\Windows\System\jzAQNvo.exe
  2⤵
  PID:4676
- C:\Windows\System\OunjNXL.exe
  C:\Windows\System\OunjNXL.exe
  2⤵
  PID:4740
- C:\Windows\System\FHeOYXR.exe
  C:\Windows\System\FHeOYXR.exe
  2⤵
  PID:4804
- C:\Windows\System\EntnNMG.exe
  C:\Windows\System\EntnNMG.exe
  2⤵
  PID:4868
- C:\Windows\System\VkoqtYc.exe
  C:\Windows\System\VkoqtYc.exe
  2⤵
  PID:4960
- C:\Windows\System\jpozQnW.exe
  C:\Windows\System\jpozQnW.exe
  2⤵
  PID:5024
- C:\Windows\System\BzCyEas.exe
  C:\Windows\System\BzCyEas.exe
  2⤵
  PID:4592
- C:\Windows\System\rrFPnFs.exe
  C:\Windows\System\rrFPnFs.exe
  2⤵
  PID:4788
- C:\Windows\System\YISjJxA.exe
  C:\Windows\System\YISjJxA.exe
  2⤵
  PID:5044
- C:\Windows\System\tKKSWMV.exe
  C:\Windows\System\tKKSWMV.exe
  2⤵
  PID:4884
- C:\Windows\System\RHDLdFm.exe
  C:\Windows\System\RHDLdFm.exe
  2⤵
  PID:5072
- C:\Windows\System\uybITlC.exe
  C:\Windows\System\uybITlC.exe
  2⤵
  PID:4104
- C:\Windows\System\gntiKjV.exe
  C:\Windows\System\gntiKjV.exe
  2⤵
  PID:4216
- C:\Windows\System\qTzJCJP.exe
  C:\Windows\System\qTzJCJP.exe
  2⤵
  PID:4448
- C:\Windows\System\JpQaLiQ.exe
  C:\Windows\System\JpQaLiQ.exe
  2⤵
  PID:5104
- C:\Windows\System\udzjvyX.exe
  C:\Windows\System\udzjvyX.exe
  2⤵
  PID:3716
- C:\Windows\System\iNJpDpK.exe
  C:\Windows\System\iNJpDpK.exe
  2⤵
  PID:4384
- C:\Windows\System\dMNzEdU.exe
  C:\Windows\System\dMNzEdU.exe
  2⤵
  PID:4432
- C:\Windows\System\XtmaUPl.exe
  C:\Windows\System\XtmaUPl.exe
  2⤵
  PID:4708
- C:\Windows\System\xnRGAkb.exe
  C:\Windows\System\xnRGAkb.exe
  2⤵
  PID:4992
- C:\Windows\System\aevjMgs.exe
  C:\Windows\System\aevjMgs.exe
  2⤵
  PID:4720
- C:\Windows\System\AMfinBr.exe
  C:\Windows\System\AMfinBr.exe
  2⤵
  PID:4628
- C:\Windows\System\WpXPFbe.exe
  C:\Windows\System\WpXPFbe.exe
  2⤵
  PID:5056
- C:\Windows\System\YShNPGV.exe
  C:\Windows\System\YShNPGV.exe
  2⤵
  PID:4496
- C:\Windows\System\fgGxkfF.exe
  C:\Windows\System\fgGxkfF.exe
  2⤵
  PID:5040
- C:\Windows\System\CCimJPP.exe
  C:\Windows\System\CCimJPP.exe
  2⤵
  PID:4752
- C:\Windows\System\eVvPJHs.exe
  C:\Windows\System\eVvPJHs.exe
  2⤵
  PID:4852
- C:\Windows\System\nyAoIOO.exe
  C:\Windows\System\nyAoIOO.exe
  2⤵
  PID:5008
- C:\Windows\System\iLoCGQM.exe
  C:\Windows\System\iLoCGQM.exe
  2⤵
  PID:4320
- C:\Windows\System\pAaRvRR.exe
  C:\Windows\System\pAaRvRR.exe
  2⤵
  PID:3076
- C:\Windows\System\DpThegr.exe
  C:\Windows\System\DpThegr.exe
  2⤵
  PID:4736
- C:\Windows\System\qRinVxF.exe
  C:\Windows\System\qRinVxF.exe
  2⤵
  PID:5012
- C:\Windows\System\pDdemQP.exe
  C:\Windows\System\pDdemQP.exe
  2⤵
  PID:4136
- C:\Windows\System\NSsMfrG.exe
  C:\Windows\System\NSsMfrG.exe
  2⤵
  PID:4200
- C:\Windows\System\RGAoFCJ.exe
  C:\Windows\System\RGAoFCJ.exe
  2⤵
  PID:4560
- C:\Windows\System\tpcgqaF.exe
  C:\Windows\System\tpcgqaF.exe
  2⤵
  PID:4464
- C:\Windows\System\tcCTOKe.exe
  C:\Windows\System\tcCTOKe.exe
  2⤵
  PID:3844
- C:\Windows\System\mOoXixc.exe
  C:\Windows\System\mOoXixc.exe
  2⤵
  PID:5088
- C:\Windows\System\QAxYtoG.exe
  C:\Windows\System\QAxYtoG.exe
  2⤵
  PID:4928
- C:\Windows\System\VBPVIEa.exe
  C:\Windows\System\VBPVIEa.exe
  2⤵
  PID:4400
- C:\Windows\System\lDqbSbQ.exe
  C:\Windows\System\lDqbSbQ.exe
  2⤵
  PID:4132
- C:\Windows\System\TFbDrmd.exe
  C:\Windows\System\TFbDrmd.exe
  2⤵
  PID:316
- C:\Windows\System\rgkYoat.exe
  C:\Windows\System\rgkYoat.exe
  2⤵
  PID:3508
- C:\Windows\System\AlHrrGJ.exe
  C:\Windows\System\AlHrrGJ.exe
  2⤵
  PID:5136
- C:\Windows\System\GSkWlTg.exe
  C:\Windows\System\GSkWlTg.exe
  2⤵
  PID:5152
- C:\Windows\System\XmRUgPC.exe
  C:\Windows\System\XmRUgPC.exe
  2⤵
  PID:5168
- C:\Windows\System\ekPFMNM.exe
  C:\Windows\System\ekPFMNM.exe
  2⤵
  PID:5288
- C:\Windows\System\JHPyCIg.exe
  C:\Windows\System\JHPyCIg.exe
  2⤵
  PID:5492
- C:\Windows\System\ttoZRSJ.exe
  C:\Windows\System\ttoZRSJ.exe
  2⤵
  PID:5580
- C:\Windows\System\GNsOFZM.exe
  C:\Windows\System\GNsOFZM.exe
  2⤵
  PID:5596
- C:\Windows\System\lPuMToU.exe
  C:\Windows\System\lPuMToU.exe
  2⤵
  PID:5612
- C:\Windows\System\eutiluO.exe
  C:\Windows\System\eutiluO.exe
  2⤵
  PID:5632
- C:\Windows\System\XMhbOmo.exe
  C:\Windows\System\XMhbOmo.exe
  2⤵
  PID:5648
- C:\Windows\System\BVNheGj.exe
  C:\Windows\System\BVNheGj.exe
  2⤵
  PID:5664
- C:\Windows\System\TPGyhWq.exe
  C:\Windows\System\TPGyhWq.exe
  2⤵
  PID:5680
- C:\Windows\System\cvgKmbi.exe
  C:\Windows\System\cvgKmbi.exe
  2⤵
  PID:5760
- C:\Windows\System\GrWMIjM.exe
  C:\Windows\System\GrWMIjM.exe
  2⤵
  PID:5776
- C:\Windows\System\pmTRPdG.exe
  C:\Windows\System\pmTRPdG.exe
  2⤵
  PID:5792
- C:\Windows\System\bcHnkEF.exe
  C:\Windows\System\bcHnkEF.exe
  2⤵
  PID:5892
- C:\Windows\System\uyjmpSj.exe
  C:\Windows\System\uyjmpSj.exe
  2⤵
  PID:5908
- C:\Windows\System\hmjWerP.exe
  C:\Windows\System\hmjWerP.exe
  2⤵
  PID:5924
- C:\Windows\System\TyHurJa.exe
  C:\Windows\System\TyHurJa.exe
  2⤵
  PID:5944
- C:\Windows\System\aPZGRBV.exe
  C:\Windows\System\aPZGRBV.exe
  2⤵
  PID:5964
- C:\Windows\System\TObCxGh.exe
  C:\Windows\System\TObCxGh.exe
  2⤵
  PID:5980
- C:\Windows\System\BoHJwgn.exe
  C:\Windows\System\BoHJwgn.exe
  2⤵
  PID:6000
- C:\Windows\System\GheqXLm.exe
  C:\Windows\System\GheqXLm.exe
  2⤵
  PID:6016
- C:\Windows\System\nJUkFkz.exe
  C:\Windows\System\nJUkFkz.exe
  2⤵
  PID:6032
- C:\Windows\System\oDYPhTP.exe
  C:\Windows\System\oDYPhTP.exe
  2⤵
  PID:6048
- C:\Windows\System\oQRiuWu.exe
  C:\Windows\System\oQRiuWu.exe
  2⤵
  PID:6064
- C:\Windows\System\MIefPrl.exe
  C:\Windows\System\MIefPrl.exe
  2⤵
  PID:6080
- C:\Windows\System\DKzSOnv.exe
  C:\Windows\System\DKzSOnv.exe
  2⤵
  PID:5148
- C:\Windows\System\qLSsVKu.exe
  C:\Windows\System\qLSsVKu.exe
  2⤵
  PID:5200
- C:\Windows\System\YqbDOPx.exe
  C:\Windows\System\YqbDOPx.exe
  2⤵
  PID:5456
- C:\Windows\System\Esuavuk.exe
  C:\Windows\System\Esuavuk.exe
  2⤵
  PID:5472
- C:\Windows\System\CECyGXv.exe
  C:\Windows\System\CECyGXv.exe
  2⤵
  PID:5280
- C:\Windows\System\LMvrhRi.exe
  C:\Windows\System\LMvrhRi.exe
  2⤵
  PID:5536
- C:\Windows\System\DadggZj.exe
  C:\Windows\System\DadggZj.exe
  2⤵
  PID:5696
- C:\Windows\System\wAWrulp.exe
  C:\Windows\System\wAWrulp.exe
  2⤵
  PID:5704
- C:\Windows\System\xoffYrz.exe
  C:\Windows\System\xoffYrz.exe
  2⤵
  PID:5656
- C:\Windows\System\aHABMnf.exe
  C:\Windows\System\aHABMnf.exe
  2⤵
  PID:5644
- C:\Windows\System\rbzROeS.exe
  C:\Windows\System\rbzROeS.exe
  2⤵
  PID:5640
- C:\Windows\System\MKzvaga.exe
  C:\Windows\System\MKzvaga.exe
  2⤵
  PID:5732
- C:\Windows\System\bieJXoo.exe
  C:\Windows\System\bieJXoo.exe
  2⤵
  PID:5752
- C:\Windows\System\DTNMmGJ.exe
  C:\Windows\System\DTNMmGJ.exe
  2⤵
  PID:5808
- C:\Windows\System\RXUmVAF.exe
  C:\Windows\System\RXUmVAF.exe
  2⤵
  PID:5828
- C:\Windows\System\qDBbnqf.exe
  C:\Windows\System\qDBbnqf.exe
  2⤵
  PID:5844
- C:\Windows\System\utWuDDb.exe
  C:\Windows\System\utWuDDb.exe
  2⤵
  PID:5856
- C:\Windows\System\olLHHQA.exe
  C:\Windows\System\olLHHQA.exe
  2⤵
  PID:5972
- C:\Windows\System\mAddRVS.exe
  C:\Windows\System\mAddRVS.exe
  2⤵
  PID:5940
- C:\Windows\System\JwxkzQV.exe
  C:\Windows\System\JwxkzQV.exe
  2⤵
  PID:6044
- C:\Windows\System\UcvWkkW.exe
  C:\Windows\System\UcvWkkW.exe
  2⤵
  PID:6076
- C:\Windows\System\ovAYeHu.exe
  C:\Windows\System\ovAYeHu.exe
  2⤵
  PID:5936
- C:\Windows\System\KzMzZbX.exe
  C:\Windows\System\KzMzZbX.exe
  2⤵
  PID:5952
- C:\Windows\System\oxGtxcl.exe
  C:\Windows\System\oxGtxcl.exe
  2⤵
  PID:5996
- C:\Windows\System\VQbIdvT.exe
  C:\Windows\System\VQbIdvT.exe
  2⤵
  PID:5956
- C:\Windows\System\QYDUnaO.exe
  C:\Windows\System\QYDUnaO.exe
  2⤵
  PID:6096
- C:\Windows\System\OgKfRiQ.exe
  C:\Windows\System\OgKfRiQ.exe
  2⤵
  PID:6108
- C:\Windows\System\FuGUqlt.exe
  C:\Windows\System\FuGUqlt.exe
  2⤵
  PID:6124
- C:\Windows\System\YAiVpGc.exe
  C:\Windows\System\YAiVpGc.exe
  2⤵
  PID:5488
- C:\Windows\System\ZbTWArO.exe
  C:\Windows\System\ZbTWArO.exe
  2⤵
  PID:5128
- C:\Windows\System\BHbTOnR.exe
  C:\Windows\System\BHbTOnR.exe
  2⤵
  PID:5144
- C:\Windows\System\SJcSAdO.exe
  C:\Windows\System\SJcSAdO.exe
  2⤵
  PID:4756
- C:\Windows\System\RCIwMyz.exe
  C:\Windows\System\RCIwMyz.exe
  2⤵
  PID:4120
- C:\Windows\System\lwINtdx.exe
  C:\Windows\System\lwINtdx.exe
  2⤵
  PID:4196
- C:\Windows\System\BCCVZHx.exe
  C:\Windows\System\BCCVZHx.exe
  2⤵
  PID:3136
- C:\Windows\System\ElvSXkh.exe
  C:\Windows\System\ElvSXkh.exe
  2⤵
  PID:5228
- C:\Windows\System\YOdEKdF.exe
  C:\Windows\System\YOdEKdF.exe
  2⤵
  PID:5180
- C:\Windows\System\HLYNYKj.exe
  C:\Windows\System\HLYNYKj.exe
  2⤵
  PID:5272
- C:\Windows\System\Zdmssri.exe
  C:\Windows\System\Zdmssri.exe
  2⤵
  PID:5364
- C:\Windows\System\exQMOVc.exe
  C:\Windows\System\exQMOVc.exe
  2⤵
  PID:5380
- C:\Windows\System\vJqdjEw.exe
  C:\Windows\System\vJqdjEw.exe
  2⤵
  PID:5396
- C:\Windows\System\iZWkcTL.exe
  C:\Windows\System\iZWkcTL.exe
  2⤵
  PID:5420
- C:\Windows\System\suLhLvX.exe
  C:\Windows\System\suLhLvX.exe
  2⤵
  PID:5440
- C:\Windows\System\xgcDbtd.exe
  C:\Windows\System\xgcDbtd.exe
  2⤵
  PID:1084
- C:\Windows\System\eXOVtsl.exe
  C:\Windows\System\eXOVtsl.exe
  2⤵
  PID:5512
- C:\Windows\System\kEtLNOp.exe
  C:\Windows\System\kEtLNOp.exe
  2⤵
  PID:5516
- C:\Windows\System\APWVWeH.exe
  C:\Windows\System\APWVWeH.exe
  2⤵
  PID:5552
- C:\Windows\System\FnxOdcs.exe
  C:\Windows\System\FnxOdcs.exe
  2⤵
  PID:5588
- C:\Windows\System\mubtyrt.exe
  C:\Windows\System\mubtyrt.exe
  2⤵
  PID:5548
- C:\Windows\System\WomTtUb.exe
  C:\Windows\System\WomTtUb.exe
  2⤵
  PID:5604
- C:\Windows\System\SIMSnIA.exe
  C:\Windows\System\SIMSnIA.exe
  2⤵
  PID:5608
- C:\Windows\System\OPHXwmB.exe
  C:\Windows\System\OPHXwmB.exe
  2⤵
  PID:5768
- C:\Windows\System\ZXhPPXC.exe
  C:\Windows\System\ZXhPPXC.exe
  2⤵
  PID:5836
- C:\Windows\System\SiICXLB.exe
  C:\Windows\System\SiICXLB.exe
  2⤵
  PID:5932
- C:\Windows\System\xyRMeXV.exe
  C:\Windows\System\xyRMeXV.exe
  2⤵
  PID:5884
- C:\Windows\System\ksSUOGZ.exe
  C:\Windows\System\ksSUOGZ.exe
  2⤵
  PID:5748
- C:\Windows\System\IwtQGHm.exe
  C:\Windows\System\IwtQGHm.exe
  2⤵
  PID:5960
- C:\Windows\System\NiShwVK.exe
  C:\Windows\System\NiShwVK.exe
  2⤵
  PID:5872
- C:\Windows\System\FMSiMjO.exe
  C:\Windows\System\FMSiMjO.exe
  2⤵
  PID:6060
- C:\Windows\System\CaGqTzg.exe
  C:\Windows\System\CaGqTzg.exe
  2⤵
  PID:6116
- C:\Windows\System\FpnzwLP.exe
  C:\Windows\System\FpnzwLP.exe
  2⤵
  PID:4564
- C:\Windows\System\lPLwxPw.exe
  C:\Windows\System\lPLwxPw.exe
  2⤵
  PID:4580
- C:\Windows\System\yCHdpSP.exe
  C:\Windows\System\yCHdpSP.exe
  2⤵
  PID:6104
- C:\Windows\System\bPwaJrR.exe
  C:\Windows\System\bPwaJrR.exe
  2⤵
  PID:6132
- C:\Windows\System\yornUZD.exe
  C:\Windows\System\yornUZD.exe
  2⤵
  PID:4944
- C:\Windows\System\cUMoZyb.exe
  C:\Windows\System\cUMoZyb.exe
  2⤵
  PID:5316
- C:\Windows\System\ZvSujWz.exe
  C:\Windows\System\ZvSujWz.exe
  2⤵
  PID:5220
- C:\Windows\System\TXTAfcx.exe
  C:\Windows\System\TXTAfcx.exe
  2⤵
  PID:5256
- C:\Windows\System\TOmnYEi.exe
  C:\Windows\System\TOmnYEi.exe
  2⤵
  PID:5304
- C:\Windows\System\lVOiaZG.exe
  C:\Windows\System\lVOiaZG.exe
  2⤵
  PID:5340
- C:\Windows\System\WRVbQvo.exe
  C:\Windows\System\WRVbQvo.exe
  2⤵
  PID:5336
- C:\Windows\System\UAwFOmb.exe
  C:\Windows\System\UAwFOmb.exe
  2⤵
  PID:5360
- C:\Windows\System\nnONZxb.exe
  C:\Windows\System\nnONZxb.exe
  2⤵
  PID:5392
- C:\Windows\System\DiJIuEi.exe
  C:\Windows\System\DiJIuEi.exe
  2⤵
  PID:5452
- C:\Windows\System\NTftocf.exe
  C:\Windows\System\NTftocf.exe
  2⤵
  PID:5568
- C:\Windows\System\iSINNZz.exe
  C:\Windows\System\iSINNZz.exe
  2⤵
  PID:5756
- C:\Windows\System\jsuRRsO.exe
  C:\Windows\System\jsuRRsO.exe
  2⤵
  PID:5904
- C:\Windows\System\lHcjsMY.exe
  C:\Windows\System\lHcjsMY.exe
  2⤵
  PID:6024
- C:\Windows\System\fkRHAIq.exe
  C:\Windows\System\fkRHAIq.exe
  2⤵
  PID:4880
- C:\Windows\System\JAWEWcD.exe
  C:\Windows\System\JAWEWcD.exe
  2⤵
  PID:5800
- C:\Windows\System\YsgBwtV.exe
  C:\Windows\System\YsgBwtV.exe
  2⤵
  PID:5284
- C:\Windows\System\UUmbtVj.exe
  C:\Windows\System\UUmbtVj.exe
  2⤵
  PID:5248
- C:\Windows\System\nXjwVYz.exe
  C:\Windows\System\nXjwVYz.exe
  2⤵
  PID:5436
- C:\Windows\System\cPUVLIq.exe
  C:\Windows\System\cPUVLIq.exe
  2⤵
  PID:5308
- C:\Windows\System\hbDPTRl.exe
  C:\Windows\System\hbDPTRl.exe
  2⤵
  PID:5236
- C:\Windows\System\jOGIwMf.exe
  C:\Windows\System\jOGIwMf.exe
  2⤵
  PID:5424
- C:\Windows\System\yXEiact.exe
  C:\Windows\System\yXEiact.exe
  2⤵
  PID:5712
- C:\Windows\System\KdoNqHM.exe
  C:\Windows\System\KdoNqHM.exe
  2⤵
  PID:5880
- C:\Windows\System\YHmozEU.exe
  C:\Windows\System\YHmozEU.exe
  2⤵
  PID:5268
- C:\Windows\System\lEwbqLd.exe
  C:\Windows\System\lEwbqLd.exe
  2⤵
  PID:5332
- C:\Windows\System\tTqAwRF.exe
  C:\Windows\System\tTqAwRF.exe
  2⤵
  PID:5528
- C:\Windows\System\ccAlzOq.exe
  C:\Windows\System\ccAlzOq.exe
  2⤵
  PID:6100
- C:\Windows\System\YmagTtp.exe
  C:\Windows\System\YmagTtp.exe
  2⤵
  PID:5916
- C:\Windows\System\vEMpZWE.exe
  C:\Windows\System\vEMpZWE.exe
  2⤵
  PID:5572
- C:\Windows\System\mfpcnTX.exe
  C:\Windows\System\mfpcnTX.exe
  2⤵
  PID:5676
- C:\Windows\System\PvKKeKY.exe
  C:\Windows\System\PvKKeKY.exe
  2⤵
  PID:5564
- C:\Windows\System\joWlxpt.exe
  C:\Windows\System\joWlxpt.exe
  2⤵
  PID:5432
- C:\Windows\System\NIqTgBw.exe
  C:\Windows\System\NIqTgBw.exe
  2⤵
  PID:5312
- C:\Windows\System\flgmTgb.exe
  C:\Windows\System\flgmTgb.exe
  2⤵
  PID:5480
- C:\Windows\System\dzkzGpY.exe
  C:\Windows\System\dzkzGpY.exe
  2⤵
  PID:5324
- C:\Windows\System\UNzDNso.exe
  C:\Windows\System\UNzDNso.exe
  2⤵
  PID:5988
- C:\Windows\System\YbpQprW.exe
  C:\Windows\System\YbpQprW.exe
  2⤵
  PID:5672
- C:\Windows\System\sdIRcSG.exe
  C:\Windows\System\sdIRcSG.exe
  2⤵
  PID:5356
- C:\Windows\System\DCpwvMH.exe
  C:\Windows\System\DCpwvMH.exe
  2⤵
  PID:5720
- C:\Windows\System\WCfROxQ.exe
  C:\Windows\System\WCfROxQ.exe
  2⤵
  PID:5812
- C:\Windows\System\yJOtHmy.exe
  C:\Windows\System\yJOtHmy.exe
  2⤵
  PID:6156
- C:\Windows\System\SmlBxNL.exe
  C:\Windows\System\SmlBxNL.exe
  2⤵
  PID:6172
- C:\Windows\System\YtAmUAV.exe
  C:\Windows\System\YtAmUAV.exe
  2⤵
  PID:6188
- C:\Windows\System\IbeRyIY.exe
  C:\Windows\System\IbeRyIY.exe
  2⤵
  PID:6208
- C:\Windows\System\PZjPofg.exe
  C:\Windows\System\PZjPofg.exe
  2⤵
  PID:6224
- C:\Windows\System\YfcdUxN.exe
  C:\Windows\System\YfcdUxN.exe
  2⤵
  PID:6256
- C:\Windows\System\vlXPUeH.exe
  C:\Windows\System\vlXPUeH.exe
  2⤵
  PID:6276
- C:\Windows\System\jNSsXJp.exe
  C:\Windows\System\jNSsXJp.exe
  2⤵
  PID:6292
- C:\Windows\System\kORWiJL.exe
  C:\Windows\System\kORWiJL.exe
  2⤵
  PID:6308
- C:\Windows\System\TUNvNCB.exe
  C:\Windows\System\TUNvNCB.exe
  2⤵
  PID:6324
- C:\Windows\System\SpTSPSv.exe
  C:\Windows\System\SpTSPSv.exe
  2⤵
  PID:6340
- C:\Windows\System\mfrZcyB.exe
  C:\Windows\System\mfrZcyB.exe
  2⤵
  PID:6356
- C:\Windows\System\LxwORSc.exe
  C:\Windows\System\LxwORSc.exe
  2⤵
  PID:6372
- C:\Windows\System\JvEdsOL.exe
  C:\Windows\System\JvEdsOL.exe
  2⤵
  PID:6388
- C:\Windows\System\yOkiajK.exe
  C:\Windows\System\yOkiajK.exe
  2⤵
  PID:6404
- C:\Windows\System\MUruaKn.exe
  C:\Windows\System\MUruaKn.exe
  2⤵
  PID:6420
- C:\Windows\System\OnKJBwo.exe
  C:\Windows\System\OnKJBwo.exe
  2⤵
  PID:6444
- C:\Windows\System\DjnwPih.exe
  C:\Windows\System\DjnwPih.exe
  2⤵
  PID:6460
- C:\Windows\System\pYWFFKp.exe
  C:\Windows\System\pYWFFKp.exe
  2⤵
  PID:6476
- C:\Windows\System\eWmJJCi.exe
  C:\Windows\System\eWmJJCi.exe
  2⤵
  PID:6496
- C:\Windows\System\omwkkEe.exe
  C:\Windows\System\omwkkEe.exe
  2⤵
  PID:6512
- C:\Windows\System\gEmqlqe.exe
  C:\Windows\System\gEmqlqe.exe
  2⤵
  PID:6528
- C:\Windows\System\XFvybxq.exe
  C:\Windows\System\XFvybxq.exe
  2⤵
  PID:6544
- C:\Windows\System\LOePeRL.exe
  C:\Windows\System\LOePeRL.exe
  2⤵
  PID:6560
- C:\Windows\System\KvuNOBP.exe
  C:\Windows\System\KvuNOBP.exe
  2⤵
  PID:6576
- C:\Windows\System\UcExDaK.exe
  C:\Windows\System\UcExDaK.exe
  2⤵
  PID:6592
- C:\Windows\System\NbUQMAN.exe
  C:\Windows\System\NbUQMAN.exe
  2⤵
  PID:6608
- C:\Windows\System\TdebkMQ.exe
  C:\Windows\System\TdebkMQ.exe
  2⤵
  PID:6624
- C:\Windows\System\pdExSrn.exe
  C:\Windows\System\pdExSrn.exe
  2⤵
  PID:6640
- C:\Windows\System\pZWhtwQ.exe
  C:\Windows\System\pZWhtwQ.exe
  2⤵
  PID:6656
- C:\Windows\System\CjNvxIf.exe
  C:\Windows\System\CjNvxIf.exe
  2⤵
  PID:6672
- C:\Windows\System\zpunZJT.exe
  C:\Windows\System\zpunZJT.exe
  2⤵
  PID:6688
- C:\Windows\System\vKDiGAD.exe
  C:\Windows\System\vKDiGAD.exe
  2⤵
  PID:6704
- C:\Windows\System\KnBtinZ.exe
  C:\Windows\System\KnBtinZ.exe
  2⤵
  PID:6720
- C:\Windows\System\ZjXRiCz.exe
  C:\Windows\System\ZjXRiCz.exe
  2⤵
  PID:6736
- C:\Windows\System\ugSQQES.exe
  C:\Windows\System\ugSQQES.exe
  2⤵
  PID:6752
- C:\Windows\System\pVKdxXv.exe
  C:\Windows\System\pVKdxXv.exe
  2⤵
  PID:6768
- C:\Windows\System\VrjjhaI.exe
  C:\Windows\System\VrjjhaI.exe
  2⤵
  PID:6784
- C:\Windows\System\atFAVHH.exe
  C:\Windows\System\atFAVHH.exe
  2⤵
  PID:6800
- C:\Windows\System\bGwxYcf.exe
  C:\Windows\System\bGwxYcf.exe
  2⤵
  PID:6816
- C:\Windows\System\gxpgBBM.exe
  C:\Windows\System\gxpgBBM.exe
  2⤵
  PID:6832
- C:\Windows\System\hRfrFgs.exe
  C:\Windows\System\hRfrFgs.exe
  2⤵
  PID:6848
- C:\Windows\System\GzxboTd.exe
  C:\Windows\System\GzxboTd.exe
  2⤵
  PID:6864
- C:\Windows\System\bYHqZtE.exe
  C:\Windows\System\bYHqZtE.exe
  2⤵
  PID:6884
- C:\Windows\System\zlokpXI.exe
  C:\Windows\System\zlokpXI.exe
  2⤵
  PID:6900
- C:\Windows\System\SpBvZJe.exe
  C:\Windows\System\SpBvZJe.exe
  2⤵
  PID:6916
- C:\Windows\System\ZPBtXPJ.exe
  C:\Windows\System\ZPBtXPJ.exe
  2⤵
  PID:6932
- C:\Windows\System\xIDUmJC.exe
  C:\Windows\System\xIDUmJC.exe
  2⤵
  PID:6948
- C:\Windows\System\WBvZTPD.exe
  C:\Windows\System\WBvZTPD.exe
  2⤵
  PID:6964
- C:\Windows\System\SqJRXRj.exe
  C:\Windows\System\SqJRXRj.exe
  2⤵
  PID:6980
- C:\Windows\System\fSuttzm.exe
  C:\Windows\System\fSuttzm.exe
  2⤵
  PID:6996
- C:\Windows\System\nihFOLh.exe
  C:\Windows\System\nihFOLh.exe
  2⤵
  PID:7012
- C:\Windows\System\HBdrTaj.exe
  C:\Windows\System\HBdrTaj.exe
  2⤵
  PID:7028
- C:\Windows\System\tdkYmLr.exe
  C:\Windows\System\tdkYmLr.exe
  2⤵
  PID:7044
- C:\Windows\System\vNjCoYj.exe
  C:\Windows\System\vNjCoYj.exe
  2⤵
  PID:7060
- C:\Windows\System\vNitbRk.exe
  C:\Windows\System\vNitbRk.exe
  2⤵
  PID:7076
- C:\Windows\System\xNcEkYI.exe
  C:\Windows\System\xNcEkYI.exe
  2⤵
  PID:7092
- C:\Windows\System\fbRMFXe.exe
  C:\Windows\System\fbRMFXe.exe
  2⤵
  PID:7108
- C:\Windows\System\ZOeqJhJ.exe
  C:\Windows\System\ZOeqJhJ.exe
  2⤵
  PID:7124
- C:\Windows\System\EhWvCCN.exe
  C:\Windows\System\EhWvCCN.exe
  2⤵
  PID:7140
- C:\Windows\System\fLXPKtO.exe
  C:\Windows\System\fLXPKtO.exe
  2⤵
  PID:7160
- C:\Windows\System\yqLMuNO.exe
  C:\Windows\System\yqLMuNO.exe
  2⤵
  PID:5368
- C:\Windows\System\tzcsAVb.exe
  C:\Windows\System\tzcsAVb.exe
  2⤵
  PID:5224
- C:\Windows\System\aFzdgbp.exe
  C:\Windows\System\aFzdgbp.exe
  2⤵
  PID:6152
- C:\Windows\System\lBWgjPm.exe
  C:\Windows\System\lBWgjPm.exe
  2⤵
  PID:6164
- C:\Windows\System\hqByXtr.exe
  C:\Windows\System\hqByXtr.exe
  2⤵
  PID:6204
- C:\Windows\System\JuJTVvg.exe
  C:\Windows\System\JuJTVvg.exe
  2⤵
  PID:6244
- C:\Windows\System\NtDOArW.exe
  C:\Windows\System\NtDOArW.exe
  2⤵
  PID:6272
- C:\Windows\System\wdAQPlf.exe
  C:\Windows\System\wdAQPlf.exe
  2⤵
  PID:6364
- C:\Windows\System\jRKnPLV.exe
  C:\Windows\System\jRKnPLV.exe
  2⤵
  PID:6400
- C:\Windows\System\LdAgXGV.exe
  C:\Windows\System\LdAgXGV.exe
  2⤵
  PID:6284
- C:\Windows\System\pngnHMa.exe
  C:\Windows\System\pngnHMa.exe
  2⤵
  PID:6352
- C:\Windows\System\xNpzhdZ.exe
  C:\Windows\System\xNpzhdZ.exe
  2⤵
  PID:6436
- C:\Windows\System\iAphXov.exe
  C:\Windows\System\iAphXov.exe
  2⤵
  PID:6508
- C:\Windows\System\CwvYvBA.exe
  C:\Windows\System\CwvYvBA.exe
  2⤵
  PID:6416
- C:\Windows\System\bBqdyXn.exe
  C:\Windows\System\bBqdyXn.exe
  2⤵
  PID:6600
- C:\Windows\System\OLGWSxb.exe
  C:\Windows\System\OLGWSxb.exe
  2⤵
  PID:6452
- C:\Windows\System\cZTbXMK.exe
  C:\Windows\System\cZTbXMK.exe
  2⤵
  PID:6552
- C:\Windows\System\WOkkMmG.exe
  C:\Windows\System\WOkkMmG.exe
  2⤵
  PID:6648
- C:\Windows\System\urYEeOt.exe
  C:\Windows\System\urYEeOt.exe
  2⤵
  PID:6524
- C:\Windows\System\aIeffRy.exe
  C:\Windows\System\aIeffRy.exe
  2⤵
  PID:6760
- C:\Windows\System\ClnhBzW.exe
  C:\Windows\System\ClnhBzW.exe
  2⤵
  PID:6824
- C:\Windows\System\ISLekQF.exe
  C:\Windows\System\ISLekQF.exe
  2⤵
  PID:6776
- C:\Windows\System\bkXFDnj.exe
  C:\Windows\System\bkXFDnj.exe
  2⤵
  PID:6652
- C:\Windows\System\dYLREOR.exe
  C:\Windows\System\dYLREOR.exe
  2⤵
  PID:6928
- C:\Windows\System\OEhtTlE.exe
  C:\Windows\System\OEhtTlE.exe
  2⤵
  PID:6748
- C:\Windows\System\uaWGJkD.exe
  C:\Windows\System\uaWGJkD.exe
  2⤵
  PID:6940
- C:\Windows\System\uGoPfFA.exe
  C:\Windows\System\uGoPfFA.exe
  2⤵
  PID:6880
- C:\Windows\System\naEYpAJ.exe
  C:\Windows\System\naEYpAJ.exe
  2⤵
  PID:6944
- C:\Windows\System\IbIlvvl.exe
  C:\Windows\System\IbIlvvl.exe
  2⤵
  PID:6992
- C:\Windows\System\PQSOesD.exe
  C:\Windows\System\PQSOesD.exe
  2⤵
  PID:7024
- C:\Windows\System\XOrkegY.exe
  C:\Windows\System\XOrkegY.exe
  2⤵
  PID:7008
- C:\Windows\System\ekgcXdd.exe
  C:\Windows\System\ekgcXdd.exe
  2⤵
  PID:7088
- C:\Windows\System\PDcpQIT.exe
  C:\Windows\System\PDcpQIT.exe
  2⤵
  PID:7136
- C:\Windows\System\plYiwnf.exe
  C:\Windows\System\plYiwnf.exe
  2⤵
  PID:7148
- C:\Windows\System\IaGlpdk.exe
  C:\Windows\System\IaGlpdk.exe
  2⤵
  PID:5728
- C:\Windows\System\KTaGDfD.exe
  C:\Windows\System\KTaGDfD.exe
  2⤵
  PID:6184
- C:\Windows\System\rSTaHfE.exe
  C:\Windows\System\rSTaHfE.exe
  2⤵
  PID:6232
- C:\Windows\System\GBCAhml.exe
  C:\Windows\System\GBCAhml.exe
  2⤵
  PID:6220
- C:\Windows\System\IUoUVqO.exe
  C:\Windows\System\IUoUVqO.exe
  2⤵
  PID:6252
- C:\Windows\System\zbGUeUP.exe
  C:\Windows\System\zbGUeUP.exe
  2⤵
  PID:6412
- C:\Windows\System\irpgPwW.exe
  C:\Windows\System\irpgPwW.exe
  2⤵
  PID:6320
- C:\Windows\System\ZRwZzLR.exe
  C:\Windows\System\ZRwZzLR.exe
  2⤵
  PID:6616
- C:\Windows\System\ULHAFfa.exe
  C:\Windows\System\ULHAFfa.exe
  2⤵
  PID:6456
- C:\Windows\System\rThwqwA.exe
  C:\Windows\System\rThwqwA.exe
  2⤵
  PID:6584
- C:\Windows\System\RaSvlqS.exe
  C:\Windows\System\RaSvlqS.exe
  2⤵
  PID:6792
- C:\Windows\System\oBOgHqz.exe
  C:\Windows\System\oBOgHqz.exe
  2⤵
  PID:6572
- C:\Windows\System\QuYHMgd.exe
  C:\Windows\System\QuYHMgd.exe
  2⤵
  PID:6780
- C:\Windows\System\BDrwXTm.exe
  C:\Windows\System\BDrwXTm.exe
  2⤵
  PID:6956
- C:\Windows\System\pAfbVRd.exe
  C:\Windows\System\pAfbVRd.exe
  2⤵
  PID:6744
- C:\Windows\System\RVFeABy.exe
  C:\Windows\System\RVFeABy.exe
  2⤵
  PID:7084
- C:\Windows\System\QtYFMsg.exe
  C:\Windows\System\QtYFMsg.exe
  2⤵
  PID:7104
- C:\Windows\System\Cslgueg.exe
  C:\Windows\System\Cslgueg.exe
  2⤵
  PID:6148
- C:\Windows\System\kIOPhPN.exe
  C:\Windows\System\kIOPhPN.exe
  2⤵
  PID:6168
- C:\Windows\System\alxDlmt.exe
  C:\Windows\System\alxDlmt.exe
  2⤵
  PID:6304
- C:\Windows\System\ZyuUbJQ.exe
  C:\Windows\System\ZyuUbJQ.exe
  2⤵
  PID:6468
- C:\Windows\System\ggvujKe.exe
  C:\Windows\System\ggvujKe.exe
  2⤵
  PID:6504
- C:\Windows\System\FvEOfVC.exe
  C:\Windows\System\FvEOfVC.exe
  2⤵
  PID:6484
- C:\Windows\System\UpDqRka.exe
  C:\Windows\System\UpDqRka.exe
  2⤵
  PID:6796
- C:\Windows\System\hxgNACv.exe
  C:\Windows\System\hxgNACv.exe
  2⤵
  PID:6520
- C:\Windows\System\EzPKaeE.exe
  C:\Windows\System\EzPKaeE.exe
  2⤵
  PID:6200
- C:\Windows\System\AkZdTfZ.exe
  C:\Windows\System\AkZdTfZ.exe
  2⤵
  PID:7040
- C:\Windows\System\NNoUjYV.exe
  C:\Windows\System\NNoUjYV.exe
  2⤵
  PID:6472
- C:\Windows\System\cylCIyt.exe
  C:\Windows\System\cylCIyt.exe
  2⤵
  PID:6896
- C:\Windows\System\vtNSKMu.exe
  C:\Windows\System\vtNSKMu.exe
  2⤵
  PID:7116
- C:\Windows\System\kADRSyr.exe
  C:\Windows\System\kADRSyr.exe
  2⤵
  PID:6632
- C:\Windows\System\dCbcovT.exe
  C:\Windows\System\dCbcovT.exe
  2⤵
  PID:6540
- C:\Windows\System\QgmJWme.exe
  C:\Windows\System\QgmJWme.exe
  2⤵
  PID:7036
- C:\Windows\System\xfrBFAa.exe
  C:\Windows\System\xfrBFAa.exe
  2⤵
  PID:6976
- C:\Windows\System\ZwrWkZo.exe
  C:\Windows\System\ZwrWkZo.exe
  2⤵
  PID:1588
- C:\Windows\System\zFmfFIh.exe
  C:\Windows\System\zFmfFIh.exe
  2⤵
  PID:7180
- C:\Windows\System\lwBqDpO.exe
  C:\Windows\System\lwBqDpO.exe
  2⤵
  PID:7196
- C:\Windows\System\DIfpGcg.exe
  C:\Windows\System\DIfpGcg.exe
  2⤵
  PID:7212
- C:\Windows\System\vXEUJgE.exe
  C:\Windows\System\vXEUJgE.exe
  2⤵
  PID:7228
- C:\Windows\System\UAUJJat.exe
  C:\Windows\System\UAUJJat.exe
  2⤵
  PID:7244
- C:\Windows\System\Fzkrvhb.exe
  C:\Windows\System\Fzkrvhb.exe
  2⤵
  PID:7260
- C:\Windows\System\iGRudEv.exe
  C:\Windows\System\iGRudEv.exe
  2⤵
  PID:7276
- C:\Windows\System\zjTuQEa.exe
  C:\Windows\System\zjTuQEa.exe
  2⤵
  PID:7292
- C:\Windows\System\KIIkZrD.exe
  C:\Windows\System\KIIkZrD.exe
  2⤵
  PID:7308
- C:\Windows\System\EXJnqUz.exe
  C:\Windows\System\EXJnqUz.exe
  2⤵
  PID:7324
- C:\Windows\System\vhrmvJj.exe
  C:\Windows\System\vhrmvJj.exe
  2⤵
  PID:7340
- C:\Windows\System\DhHjkyF.exe
  C:\Windows\System\DhHjkyF.exe
  2⤵
  PID:7356
- C:\Windows\System\vJnaDyI.exe
  C:\Windows\System\vJnaDyI.exe
  2⤵
  PID:7372
- C:\Windows\System\CCjyCbH.exe
  C:\Windows\System\CCjyCbH.exe
  2⤵
  PID:7388
- C:\Windows\System\OjrgetW.exe
  C:\Windows\System\OjrgetW.exe
  2⤵
  PID:7404
- C:\Windows\System\rLxKsxi.exe
  C:\Windows\System\rLxKsxi.exe
  2⤵
  PID:7420
- C:\Windows\System\WqxlMlP.exe
  C:\Windows\System\WqxlMlP.exe
  2⤵
  PID:7436
- C:\Windows\System\DHXcbIf.exe
  C:\Windows\System\DHXcbIf.exe
  2⤵
  PID:7452
- C:\Windows\System\TRdmaaJ.exe
  C:\Windows\System\TRdmaaJ.exe
  2⤵
  PID:7468
- C:\Windows\System\HZJWafk.exe
  C:\Windows\System\HZJWafk.exe
  2⤵
  PID:7484
- C:\Windows\System\FSXOKIA.exe
  C:\Windows\System\FSXOKIA.exe
  2⤵
  PID:7500
- C:\Windows\System\qicksfB.exe
  C:\Windows\System\qicksfB.exe
  2⤵
  PID:7516
- C:\Windows\System\sXwKqhp.exe
  C:\Windows\System\sXwKqhp.exe
  2⤵
  PID:7532
- C:\Windows\System\GaXhihk.exe
  C:\Windows\System\GaXhihk.exe
  2⤵
  PID:7548
- C:\Windows\System\tiUzHbo.exe
  C:\Windows\System\tiUzHbo.exe
  2⤵
  PID:7564
- C:\Windows\System\jAZAVSH.exe
  C:\Windows\System\jAZAVSH.exe
  2⤵
  PID:7580
- C:\Windows\System\VurnnJP.exe
  C:\Windows\System\VurnnJP.exe
  2⤵
  PID:7596
- C:\Windows\System\pqSLcnI.exe
  C:\Windows\System\pqSLcnI.exe
  2⤵
  PID:7612
- C:\Windows\System\CCCAywz.exe
  C:\Windows\System\CCCAywz.exe
  2⤵
  PID:7628
- C:\Windows\System\KmEEhDS.exe
  C:\Windows\System\KmEEhDS.exe
  2⤵
  PID:7644
- C:\Windows\System\FxZEOqm.exe
  C:\Windows\System\FxZEOqm.exe
  2⤵
  PID:7660
- C:\Windows\System\LIbeNsj.exe
  C:\Windows\System\LIbeNsj.exe
  2⤵
  PID:7676
- C:\Windows\System\EJWYZJB.exe
  C:\Windows\System\EJWYZJB.exe
  2⤵
  PID:7692
- C:\Windows\System\vqibnEP.exe
  C:\Windows\System\vqibnEP.exe
  2⤵
  PID:7708
- C:\Windows\System\ncNPHNo.exe
  C:\Windows\System\ncNPHNo.exe
  2⤵
  PID:7724
- C:\Windows\System\wAcnDde.exe
  C:\Windows\System\wAcnDde.exe
  2⤵
  PID:7740
- C:\Windows\System\BLkrRoD.exe
  C:\Windows\System\BLkrRoD.exe
  2⤵
  PID:7756
- C:\Windows\System\XHBUEsK.exe
  C:\Windows\System\XHBUEsK.exe
  2⤵
  PID:7772
- C:\Windows\System\ymxTlXO.exe
  C:\Windows\System\ymxTlXO.exe
  2⤵
  PID:7788
- C:\Windows\System\euAPskF.exe
  C:\Windows\System\euAPskF.exe
  2⤵
  PID:7804
- C:\Windows\System\SsjjwDA.exe
  C:\Windows\System\SsjjwDA.exe
  2⤵
  PID:7820
- C:\Windows\System\AJaqtKZ.exe
  C:\Windows\System\AJaqtKZ.exe
  2⤵
  PID:7836
- C:\Windows\System\xEaEbUk.exe
  C:\Windows\System\xEaEbUk.exe
  2⤵
  PID:7852
- C:\Windows\System\YEFALYS.exe
  C:\Windows\System\YEFALYS.exe
  2⤵
  PID:7868
- C:\Windows\System\vGLyUTE.exe
  C:\Windows\System\vGLyUTE.exe
  2⤵
  PID:7884
- C:\Windows\System\wxidlMz.exe
  C:\Windows\System\wxidlMz.exe
  2⤵
  PID:7900
- C:\Windows\System\mboynAo.exe
  C:\Windows\System\mboynAo.exe
  2⤵
  PID:7916
- C:\Windows\System\olZcERh.exe
  C:\Windows\System\olZcERh.exe
  2⤵
  PID:7932
- C:\Windows\System\wSxjWpS.exe
  C:\Windows\System\wSxjWpS.exe
  2⤵
  PID:7948
- C:\Windows\System\QEDxGdZ.exe
  C:\Windows\System\QEDxGdZ.exe
  2⤵
  PID:7964
- C:\Windows\System\XfBFIgC.exe
  C:\Windows\System\XfBFIgC.exe
  2⤵
  PID:7984
- C:\Windows\System\EGEKhHw.exe
  C:\Windows\System\EGEKhHw.exe
  2⤵
  PID:8000
- C:\Windows\System\mNGKisK.exe
  C:\Windows\System\mNGKisK.exe
  2⤵
  PID:8016
- C:\Windows\System\UUOmdoP.exe
  C:\Windows\System\UUOmdoP.exe
  2⤵
  PID:8032
- C:\Windows\System\beHnpXK.exe
  C:\Windows\System\beHnpXK.exe
  2⤵
  PID:8048
- C:\Windows\System\XMXzkUd.exe
  C:\Windows\System\XMXzkUd.exe
  2⤵
  PID:8064
- C:\Windows\System\EGqXqbr.exe
  C:\Windows\System\EGqXqbr.exe
  2⤵
  PID:8080
- C:\Windows\System\EEJnNrH.exe
  C:\Windows\System\EEJnNrH.exe
  2⤵
  PID:8096
- C:\Windows\System\pntaFgm.exe
  C:\Windows\System\pntaFgm.exe
  2⤵
  PID:8112
- C:\Windows\System\WYkcvjc.exe
  C:\Windows\System\WYkcvjc.exe
  2⤵
  PID:8128
- C:\Windows\System\zNQBdWU.exe
  C:\Windows\System\zNQBdWU.exe
  2⤵
  PID:8144
- C:\Windows\System\LJrNPCQ.exe
  C:\Windows\System\LJrNPCQ.exe
  2⤵
  PID:8160
- C:\Windows\System\QVswtgo.exe
  C:\Windows\System\QVswtgo.exe
  2⤵
  PID:8176
- C:\Windows\System\kStXVXJ.exe
  C:\Windows\System\kStXVXJ.exe
  2⤵
  PID:7172
- C:\Windows\System\MJYMult.exe
  C:\Windows\System\MJYMult.exe
  2⤵
  PID:6236
- C:\Windows\System\FoLIwOR.exe
  C:\Windows\System\FoLIwOR.exe
  2⤵
  PID:7188
- C:\Windows\System\rvyaBoF.exe
  C:\Windows\System\rvyaBoF.exe
  2⤵
  PID:7268
- C:\Windows\System\CPonfxR.exe
  C:\Windows\System\CPonfxR.exe
  2⤵
  PID:7220
- C:\Windows\System\nHSqbEF.exe
  C:\Windows\System\nHSqbEF.exe
  2⤵
  PID:7300
- C:\Windows\System\CPfqjep.exe
  C:\Windows\System\CPfqjep.exe
  2⤵
  PID:7336
- C:\Windows\System\DLqnnWG.exe
  C:\Windows\System\DLqnnWG.exe
  2⤵
  PID:7400
- C:\Windows\System\tlgwVqJ.exe
  C:\Windows\System\tlgwVqJ.exe
  2⤵
  PID:7460
- C:\Windows\System\qFquUYh.exe
  C:\Windows\System\qFquUYh.exe
  2⤵
  PID:7348
- C:\Windows\System\QiKMskG.exe
  C:\Windows\System\QiKMskG.exe
  2⤵
  PID:7416
- C:\Windows\System\hNPmczU.exe
  C:\Windows\System\hNPmczU.exe
  2⤵
  PID:7496
- C:\Windows\System\eVguXCK.exe
  C:\Windows\System\eVguXCK.exe
  2⤵
  PID:7560
- C:\Windows\System\KUxtVPa.exe
  C:\Windows\System\KUxtVPa.exe
  2⤵
  PID:7476
- C:\Windows\System\bXxdpiT.exe
  C:\Windows\System\bXxdpiT.exe
  2⤵
  PID:7656
- C:\Windows\System\evVrIxR.exe
  C:\Windows\System\evVrIxR.exe
  2⤵
  PID:7748
- C:\Windows\System\qnqIFws.exe
  C:\Windows\System\qnqIFws.exe
  2⤵
  PID:7512
- C:\Windows\System\EgzCbqD.exe
  C:\Windows\System\EgzCbqD.exe
  2⤵
  PID:7636
- C:\Windows\System\jIlEZgu.exe
  C:\Windows\System\jIlEZgu.exe
  2⤵
  PID:7540
- C:\Windows\System\eFizxGx.exe
  C:\Windows\System\eFizxGx.exe
  2⤵
  PID:7768
- C:\Windows\System\kLhNowL.exe
  C:\Windows\System\kLhNowL.exe
  2⤵
  PID:7736
- C:\Windows\System\zJzCfpv.exe
  C:\Windows\System\zJzCfpv.exe
  2⤵
  PID:7796
- C:\Windows\System\EEOcFWD.exe
  C:\Windows\System\EEOcFWD.exe
  2⤵
  PID:7848
- C:\Windows\System\wZgWEGh.exe
  C:\Windows\System\wZgWEGh.exe
  2⤵
  PID:7880
- C:\Windows\System\KHIIVhN.exe
  C:\Windows\System\KHIIVhN.exe
  2⤵
  PID:7892
- C:\Windows\System\KKntYhc.exe
  C:\Windows\System\KKntYhc.exe
  2⤵
  PID:7864
- C:\Windows\System\GqXqGoN.exe
  C:\Windows\System\GqXqGoN.exe
  2⤵
  PID:7928
- C:\Windows\System\CkgWemm.exe
  C:\Windows\System\CkgWemm.exe
  2⤵
  PID:7996
- C:\Windows\System\DqlPamb.exe
  C:\Windows\System\DqlPamb.exe
  2⤵
  PID:8024
- C:\Windows\System\cXuOgJc.exe
  C:\Windows\System\cXuOgJc.exe
  2⤵
  PID:8072
- C:\Windows\System\jlFKkZI.exe
  C:\Windows\System\jlFKkZI.exe
  2⤵
  PID:8104
- C:\Windows\System\UEotHLv.exe
  C:\Windows\System\UEotHLv.exe
  2⤵
  PID:8168
- C:\Windows\System\gCJHxuG.exe
  C:\Windows\System\gCJHxuG.exe
  2⤵
  PID:8120
- C:\Windows\System\xBiLbPB.exe
  C:\Windows\System\xBiLbPB.exe
  2⤵
  PID:8156
- C:\Windows\System\xMYoLIM.exe
  C:\Windows\System\xMYoLIM.exe
  2⤵
  PID:6396
- C:\Windows\System\cgWOfEl.exe
  C:\Windows\System\cgWOfEl.exe
  2⤵
  PID:7284
- C:\Windows\System\sLopBdZ.exe
  C:\Windows\System\sLopBdZ.exe
  2⤵
  PID:7316
- C:\Windows\System\HBYwfmh.exe
  C:\Windows\System\HBYwfmh.exe
  2⤵
  PID:7492
- C:\Windows\System\bvBDkfW.exe
  C:\Windows\System\bvBDkfW.exe
  2⤵
  PID:7384
- C:\Windows\System\IemLeAz.exe
  C:\Windows\System\IemLeAz.exe
  2⤵
  PID:7716
- C:\Windows\System\xiIfvMN.exe
  C:\Windows\System\xiIfvMN.exe
  2⤵
  PID:7608
- C:\Windows\System\bTdsmoP.exe
  C:\Windows\System\bTdsmoP.exe
  2⤵
  PID:7684
- C:\Windows\System\opEEXkn.exe
  C:\Windows\System\opEEXkn.exe
  2⤵
  PID:7672
- C:\Windows\System\iAzcgGz.exe
  C:\Windows\System\iAzcgGz.exe
  2⤵
  PID:7764
- C:\Windows\System\uBssSSX.exe
  C:\Windows\System\uBssSSX.exe
  2⤵
  PID:7876
- C:\Windows\System\fWYagjO.exe
  C:\Windows\System\fWYagjO.exe
  2⤵
  PID:7944
- C:\Windows\System\OQYhSly.exe
  C:\Windows\System\OQYhSly.exe
  2⤵
  PID:7992
- C:\Windows\System\KzgelFO.exe
  C:\Windows\System\KzgelFO.exe
  2⤵
  PID:8040
- C:\Windows\System\mVEaVxo.exe
  C:\Windows\System\mVEaVxo.exe
  2⤵
  PID:8136
- C:\Windows\System\GEuBirO.exe
  C:\Windows\System\GEuBirO.exe
  2⤵
  PID:7256
- C:\Windows\System\tjpwuBx.exe
  C:\Windows\System\tjpwuBx.exe
  2⤵
  PID:7620
- C:\Windows\System\kxVQwXS.exe
  C:\Windows\System\kxVQwXS.exe
  2⤵
  PID:7704
- C:\Windows\System\CbZFJLp.exe
  C:\Windows\System\CbZFJLp.exe
  2⤵
  PID:7432
- C:\Windows\System\vcXDDmb.exe
  C:\Windows\System\vcXDDmb.exe
  2⤵
  PID:8184
- C:\Windows\System\JyufxgH.exe
  C:\Windows\System\JyufxgH.exe
  2⤵
  PID:6808
- C:\Windows\System\JbnWuna.exe
  C:\Windows\System\JbnWuna.exe
  2⤵
  PID:7380
- C:\Windows\System\HTQtVKq.exe
  C:\Windows\System\HTQtVKq.exe
  2⤵
  PID:7252
- C:\Windows\System\TIKZOgM.exe
  C:\Windows\System\TIKZOgM.exe
  2⤵
  PID:7784
- C:\Windows\System\THamuKF.exe
  C:\Windows\System\THamuKF.exe
  2⤵
  PID:8188
- C:\Windows\System\MAAVNiP.exe
  C:\Windows\System\MAAVNiP.exe
  2⤵
  PID:7576
- C:\Windows\System\nctZyTa.exe
  C:\Windows\System\nctZyTa.exe
  2⤵
  PID:7972
- C:\Windows\System\CbcVUmh.exe
  C:\Windows\System\CbcVUmh.exe
  2⤵
  PID:8060
- C:\Windows\System\xiXaoID.exe
  C:\Windows\System\xiXaoID.exe
  2⤵
  PID:7976
- C:\Windows\System\etSyjnl.exe
  C:\Windows\System\etSyjnl.exe
  2⤵
  PID:7396
- C:\Windows\System\wXVrKSf.exe
  C:\Windows\System\wXVrKSf.exe
  2⤵
  PID:7912
- C:\Windows\System\BWDUEgo.exe
  C:\Windows\System\BWDUEgo.exe
  2⤵
  PID:8212
- C:\Windows\System\FxifbiP.exe
  C:\Windows\System\FxifbiP.exe
  2⤵
  PID:8228
- C:\Windows\System\JIebLta.exe
  C:\Windows\System\JIebLta.exe
  2⤵
  PID:8244
- C:\Windows\System\oksDEMV.exe
  C:\Windows\System\oksDEMV.exe
  2⤵
  PID:8300
- C:\Windows\System\UUibprW.exe
  C:\Windows\System\UUibprW.exe
  2⤵
  PID:8316
- C:\Windows\System\KKkGyZE.exe
  C:\Windows\System\KKkGyZE.exe
  2⤵
  PID:8332
- C:\Windows\System\LqTGfbA.exe
  C:\Windows\System\LqTGfbA.exe
  2⤵
  PID:8348
- C:\Windows\System\dSsGSIl.exe
  C:\Windows\System\dSsGSIl.exe
  2⤵
  PID:8364
- C:\Windows\System\VrpCRom.exe
  C:\Windows\System\VrpCRom.exe
  2⤵
  PID:8436
- C:\Windows\System\IviaHXY.exe
  C:\Windows\System\IviaHXY.exe
  2⤵
  PID:8460
- C:\Windows\System\hxZyUKy.exe
  C:\Windows\System\hxZyUKy.exe
  2⤵
  PID:8480
- C:\Windows\System\IfhDnGp.exe
  C:\Windows\System\IfhDnGp.exe
  2⤵
  PID:8500
- C:\Windows\System\zGRTTek.exe
  C:\Windows\System\zGRTTek.exe
  2⤵
  PID:8516
- C:\Windows\System\NoKrUtO.exe
  C:\Windows\System\NoKrUtO.exe
  2⤵
  PID:8648
- C:\Windows\System\iAvozgG.exe
  C:\Windows\System\iAvozgG.exe
  2⤵
  PID:8784
- C:\Windows\System\KnmCroq.exe
  C:\Windows\System\KnmCroq.exe
  2⤵
  PID:8804
- C:\Windows\System\OGixPFu.exe
  C:\Windows\System\OGixPFu.exe
  2⤵
  PID:8824
- C:\Windows\System\DljGsbX.exe
  C:\Windows\System\DljGsbX.exe
  2⤵
  PID:8840
- C:\Windows\System\gROAXgl.exe
  C:\Windows\System\gROAXgl.exe
  2⤵
  PID:8860
- C:\Windows\System\wOymiwR.exe
  C:\Windows\System\wOymiwR.exe
  2⤵
  PID:8876
- C:\Windows\System\qoNjzPC.exe
  C:\Windows\System\qoNjzPC.exe
  2⤵
  PID:8896
- C:\Windows\System\MabdVmO.exe
  C:\Windows\System\MabdVmO.exe
  2⤵
  PID:8912
- C:\Windows\System\sUsggmL.exe
  C:\Windows\System\sUsggmL.exe
  2⤵
  PID:8928
- C:\Windows\System\XwxQcdx.exe
  C:\Windows\System\XwxQcdx.exe
  2⤵
  PID:8944
- C:\Windows\System\TSXywGO.exe
  C:\Windows\System\TSXywGO.exe
  2⤵
  PID:8960
- C:\Windows\System\dymOtoC.exe
  C:\Windows\System\dymOtoC.exe
  2⤵
  PID:8976
- C:\Windows\System\csAOdUe.exe
  C:\Windows\System\csAOdUe.exe
  2⤵
  PID:8992
- C:\Windows\System\srIyKLp.exe
  C:\Windows\System\srIyKLp.exe
  2⤵
  PID:9008
- C:\Windows\System\ceZpSsO.exe
  C:\Windows\System\ceZpSsO.exe
  2⤵
  PID:9024
- C:\Windows\System\tMIhLNH.exe
  C:\Windows\System\tMIhLNH.exe
  2⤵
  PID:9040
- C:\Windows\System\ycRTFfo.exe
  C:\Windows\System\ycRTFfo.exe
  2⤵
  PID:9056
- C:\Windows\System\TqvIKuS.exe
  C:\Windows\System\TqvIKuS.exe
  2⤵
  PID:9072
- C:\Windows\System\lzvLCgT.exe
  C:\Windows\System\lzvLCgT.exe
  2⤵
  PID:9088
- C:\Windows\System\qEXHQAv.exe
  C:\Windows\System\qEXHQAv.exe
  2⤵
  PID:9104
- C:\Windows\System\fTCRHED.exe
  C:\Windows\System\fTCRHED.exe
  2⤵
  PID:9120
- C:\Windows\System\FWwhsgC.exe
  C:\Windows\System\FWwhsgC.exe
  2⤵
  PID:9136
- C:\Windows\System\GnWBouU.exe
  C:\Windows\System\GnWBouU.exe
  2⤵
  PID:9152
- C:\Windows\System\dlorDqP.exe
  C:\Windows\System\dlorDqP.exe
  2⤵
  PID:9168
- C:\Windows\System\HHYNopb.exe
  C:\Windows\System\HHYNopb.exe
  2⤵
  PID:9184
- C:\Windows\System\GErrGpB.exe
  C:\Windows\System\GErrGpB.exe
  2⤵
  PID:9200
- C:\Windows\System\IAULmAh.exe
  C:\Windows\System\IAULmAh.exe
  2⤵
  PID:8200
- C:\Windows\System\ICjLfYw.exe
  C:\Windows\System\ICjLfYw.exe
  2⤵
  PID:8152
- C:\Windows\System\cXjtApX.exe
  C:\Windows\System\cXjtApX.exe
  2⤵
  PID:8224
- C:\Windows\System\cUoerXm.exe
  C:\Windows\System\cUoerXm.exe
  2⤵
  PID:8292
- C:\Windows\System\VSwfIEd.exe
  C:\Windows\System\VSwfIEd.exe
  2⤵
  PID:8340
- C:\Windows\System\VmYaTvX.exe
  C:\Windows\System\VmYaTvX.exe
  2⤵
  PID:8380
- C:\Windows\System\JFVgVxW.exe
  C:\Windows\System\JFVgVxW.exe
  2⤵
  PID:8268
- C:\Windows\System\RMsLyZN.exe
  C:\Windows\System\RMsLyZN.exe
  2⤵
  PID:8280
- C:\Windows\System\QSTpPsp.exe
  C:\Windows\System\QSTpPsp.exe
  2⤵
  PID:8328
- C:\Windows\System\LDnmkPE.exe
  C:\Windows\System\LDnmkPE.exe
  2⤵
  PID:8388
- C:\Windows\System\KdkkQXD.exe
  C:\Windows\System\KdkkQXD.exe
  2⤵
  PID:8404
- C:\Windows\System\hdStfbU.exe
  C:\Windows\System\hdStfbU.exe
  2⤵
  PID:8424
- C:\Windows\System\AGqbfow.exe
  C:\Windows\System\AGqbfow.exe
  2⤵
  PID:8448
- C:\Windows\System\TzwoJIw.exe
  C:\Windows\System\TzwoJIw.exe
  2⤵
  PID:8444
- C:\Windows\System\TkIvRfS.exe
  C:\Windows\System\TkIvRfS.exe
  2⤵
  PID:8492
- C:\Windows\System\JxLHFRf.exe
  C:\Windows\System\JxLHFRf.exe
  2⤵
  PID:8524
- C:\Windows\System\uQmlBxA.exe
  C:\Windows\System\uQmlBxA.exe
  2⤵
  PID:8660
- C:\Windows\System\NgbbGQo.exe
  C:\Windows\System\NgbbGQo.exe
  2⤵
  PID:8672
- C:\Windows\System\ekVpckx.exe
  C:\Windows\System\ekVpckx.exe
  2⤵
  PID:8688
- C:\Windows\System\AWSEOmo.exe
  C:\Windows\System\AWSEOmo.exe
  2⤵
  PID:8716
- C:\Windows\System\ngiiAzj.exe
  C:\Windows\System\ngiiAzj.exe
  2⤵
  PID:8752
- C:\Windows\System\kOmfBOO.exe
  C:\Windows\System\kOmfBOO.exe
  2⤵
  PID:8768
- C:\Windows\System\ESRxmJQ.exe
  C:\Windows\System\ESRxmJQ.exe
  2⤵
  PID:8816
- C:\Windows\System\BznYiCh.exe
  C:\Windows\System\BznYiCh.exe
  2⤵
  PID:8856
- C:\Windows\System\eIqxdnV.exe
  C:\Windows\System\eIqxdnV.exe
  2⤵
  PID:8920
- C:\Windows\System\wsFuXqH.exe
  C:\Windows\System\wsFuXqH.exe
  2⤵
  PID:8832
- C:\Windows\System\ZNehMcU.exe
  C:\Windows\System\ZNehMcU.exe
  2⤵
  PID:9048
- C:\Windows\System\iSoSWHI.exe
  C:\Windows\System\iSoSWHI.exe
  2⤵
  PID:9192
- C:\Windows\System\WZyZmHr.exe
  C:\Windows\System\WZyZmHr.exe
  2⤵
  PID:9132
- C:\Windows\System\yQVmVZX.exe
  C:\Windows\System\yQVmVZX.exe
  2⤵
  PID:8296
- C:\Windows\System\XOZIIvJ.exe
  C:\Windows\System\XOZIIvJ.exe
  2⤵
  PID:8260
- C:\Windows\System\DmukfPN.exe
  C:\Windows\System\DmukfPN.exe
  2⤵
  PID:9068
- C:\Windows\System\bvwgMvd.exe
  C:\Windows\System\bvwgMvd.exe
  2⤵
  PID:8396
- C:\Windows\System\UBszgZc.exe
  C:\Windows\System\UBszgZc.exe
  2⤵
  PID:8240
- C:\Windows\System\DYOLoVM.exe
  C:\Windows\System\DYOLoVM.exe
  2⤵
  PID:8416
- C:\Windows\System\GiDKVZH.exe
  C:\Windows\System\GiDKVZH.exe
  2⤵
  PID:8456
- C:\Windows\System\tbsWEhs.exe
  C:\Windows\System\tbsWEhs.exe
  2⤵
  PID:8372
- C:\Windows\System\hTlWfSj.exe
  C:\Windows\System\hTlWfSj.exe
  2⤵
  PID:8496
- C:\Windows\System\pWufHGm.exe
  C:\Windows\System\pWufHGm.exe
  2⤵
  PID:8564
- C:\Windows\System\IhonYVZ.exe
  C:\Windows\System\IhonYVZ.exe
  2⤵
  PID:8576
- C:\Windows\System\PtJeJMQ.exe
  C:\Windows\System\PtJeJMQ.exe
  2⤵
  PID:8592
- C:\Windows\System\KQxLNBX.exe
  C:\Windows\System\KQxLNBX.exe
  2⤵
  PID:8608
- C:\Windows\System\PnAmkuz.exe
  C:\Windows\System\PnAmkuz.exe
  2⤵
  PID:8632
- C:\Windows\System\EGUBXMl.exe
  C:\Windows\System\EGUBXMl.exe
  2⤵
  PID:8680
- C:\Windows\System\yNyTDuJ.exe
  C:\Windows\System\yNyTDuJ.exe
  2⤵
  PID:8696
- C:\Windows\System\lDjWVXx.exe
  C:\Windows\System\lDjWVXx.exe
  2⤵
  PID:8712
- C:\Windows\System\koFgapv.exe
  C:\Windows\System\koFgapv.exe
  2⤵
  PID:8764
- C:\Windows\System\eMnUmTb.exe
  C:\Windows\System\eMnUmTb.exe
  2⤵
  PID:8732
- C:\Windows\System\QEbRhSr.exe
  C:\Windows\System\QEbRhSr.exe
  2⤵
  PID:8740
- C:\Windows\System\fXpcFYN.exe
  C:\Windows\System\fXpcFYN.exe
  2⤵
  PID:8892
- C:\Windows\System\gwbxgvC.exe
  C:\Windows\System\gwbxgvC.exe
  2⤵
  PID:9016
- C:\Windows\System\lZsmroG.exe
  C:\Windows\System\lZsmroG.exe
  2⤵
  PID:8868
- C:\Windows\System\SlygTvh.exe
  C:\Windows\System\SlygTvh.exe
  2⤵
  PID:9116
- C:\Windows\System\JFWjmWj.exe
  C:\Windows\System\JFWjmWj.exe
  2⤵
  PID:9208
- C:\Windows\System\cKKElXm.exe
  C:\Windows\System\cKKElXm.exe
  2⤵
  PID:8968
- C:\Windows\System\rmfIeKz.exe
  C:\Windows\System\rmfIeKz.exe
  2⤵
  PID:7832
- C:\Windows\System\elouvBb.exe
  C:\Windows\System\elouvBb.exe
  2⤵
  PID:7368
- C:\Windows\System\nZvsEbE.exe
  C:\Windows\System\nZvsEbE.exe
  2⤵
  PID:8544
- C:\Windows\System\HptBjFO.exe
  C:\Windows\System\HptBjFO.exe
  2⤵
  PID:8552
- C:\Windows\System\hLFbFWu.exe
  C:\Windows\System\hLFbFWu.exe
  2⤵
  PID:8584
- C:\Windows\System\jLObdKI.exe
  C:\Windows\System\jLObdKI.exe
  2⤵
  PID:8644
- C:\Windows\System\dDWfGOc.exe
  C:\Windows\System\dDWfGOc.exe
  2⤵
  PID:8600
- C:\Windows\System\oSeawFV.exe
  C:\Windows\System\oSeawFV.exe
  2⤵
  PID:8472
- C:\Windows\System\UuMzQrJ.exe
  C:\Windows\System\UuMzQrJ.exe
  2⤵
  PID:8408
- C:\Windows\System\QODVEHu.exe
  C:\Windows\System\QODVEHu.exe
  2⤵
  PID:8708
- C:\Windows\System\IsjpNUE.exe
  C:\Windows\System\IsjpNUE.exe
  2⤵
  PID:8728
- C:\Windows\System\JSVpYOD.exe
  C:\Windows\System\JSVpYOD.exe
  2⤵
  PID:9020
- C:\Windows\System\ejMSmvz.exe
  C:\Windows\System\ejMSmvz.exe
  2⤵
  PID:9112
- C:\Windows\System\UgSYjqN.exe
  C:\Windows\System\UgSYjqN.exe
  2⤵
  PID:9004
- C:\Windows\System\awyDnGn.exe
  C:\Windows\System\awyDnGn.exe
  2⤵
  PID:8908
- C:\Windows\System\sgecKZa.exe
  C:\Windows\System\sgecKZa.exe
  2⤵
  PID:9196
- C:\Windows\System\pqsFDfy.exe
  C:\Windows\System\pqsFDfy.exe
  2⤵
  PID:8936
- C:\Windows\System\VGMEpQa.exe
  C:\Windows\System\VGMEpQa.exe
  2⤵
  PID:8548
- C:\Windows\System\QkGOEZR.exe
  C:\Windows\System\QkGOEZR.exe
  2⤵
  PID:8724
- C:\Windows\System\ipBfLRV.exe
  C:\Windows\System\ipBfLRV.exe
  2⤵
  PID:8604
- C:\Windows\System\bbELamZ.exe
  C:\Windows\System\bbELamZ.exe
  2⤵
  PID:8884
- C:\Windows\System\UHdMfAK.exe
  C:\Windows\System\UHdMfAK.exe
  2⤵
  PID:9164
- C:\Windows\System\zglJtWp.exe
  C:\Windows\System\zglJtWp.exe
  2⤵
  PID:9096
- C:\Windows\System\MfheBBY.exe
  C:\Windows\System\MfheBBY.exe
  2⤵
  PID:8628
- C:\Windows\System\dntBltN.exe
  C:\Windows\System\dntBltN.exe
  2⤵
  PID:8704
- C:\Windows\System\toWLVNO.exe
  C:\Windows\System\toWLVNO.exe
  2⤵
  PID:9232
- C:\Windows\System\glpWbFD.exe
  C:\Windows\System\glpWbFD.exe
  2⤵
  PID:9248
- C:\Windows\System\UzxYKUg.exe
  C:\Windows\System\UzxYKUg.exe
  2⤵
  PID:9264
- C:\Windows\System\VIlKsoM.exe
  C:\Windows\System\VIlKsoM.exe
  2⤵
  PID:9280
- C:\Windows\System\lNrbXte.exe
  C:\Windows\System\lNrbXte.exe
  2⤵
  PID:9296
- C:\Windows\System\AxbrFdm.exe
  C:\Windows\System\AxbrFdm.exe
  2⤵
  PID:9312
- C:\Windows\System\KEUDbSS.exe
  C:\Windows\System\KEUDbSS.exe
  2⤵
  PID:9328
- C:\Windows\System\saZBBHY.exe
  C:\Windows\System\saZBBHY.exe
  2⤵
  PID:9344
- C:\Windows\System\yXGhepp.exe
  C:\Windows\System\yXGhepp.exe
  2⤵
  PID:9360
- C:\Windows\System\zDxCZQO.exe
  C:\Windows\System\zDxCZQO.exe
  2⤵
  PID:9376
- C:\Windows\System\GVcWqvb.exe
  C:\Windows\System\GVcWqvb.exe
  2⤵
  PID:9392
- C:\Windows\System\YxZrdVt.exe
  C:\Windows\System\YxZrdVt.exe
  2⤵
  PID:9408
- C:\Windows\System\qhcnDYS.exe
  C:\Windows\System\qhcnDYS.exe
  2⤵
  PID:9480
- C:\Windows\System\hFvqUWT.exe
  C:\Windows\System\hFvqUWT.exe
  2⤵
  PID:9496
- C:\Windows\System\OTMLeSd.exe
  C:\Windows\System\OTMLeSd.exe
  2⤵
  PID:9512
- C:\Windows\System\qxbOLkK.exe
  C:\Windows\System\qxbOLkK.exe
  2⤵
  PID:9532
- C:\Windows\System\WzbNRqP.exe
  C:\Windows\System\WzbNRqP.exe
  2⤵
  PID:9548
- C:\Windows\System\fAdxuSL.exe
  C:\Windows\System\fAdxuSL.exe
  2⤵
  PID:9564
- C:\Windows\System\qiWsnSe.exe
  C:\Windows\System\qiWsnSe.exe
  2⤵
  PID:9580
- C:\Windows\System\YSinFOI.exe
  C:\Windows\System\YSinFOI.exe
  2⤵
  PID:9600
- C:\Windows\System\FXGtpWQ.exe
  C:\Windows\System\FXGtpWQ.exe
  2⤵
  PID:9616
- C:\Windows\System\HmHFZMI.exe
  C:\Windows\System\HmHFZMI.exe
  2⤵
  PID:9632
- C:\Windows\System\QCdkhDN.exe
  C:\Windows\System\QCdkhDN.exe
  2⤵
  PID:9648
- C:\Windows\System\kjFlhAY.exe
  C:\Windows\System\kjFlhAY.exe
  2⤵
  PID:9664
- C:\Windows\System\ImlygZZ.exe
  C:\Windows\System\ImlygZZ.exe
  2⤵
  PID:9680
- C:\Windows\System\xcdaHfi.exe
  C:\Windows\System\xcdaHfi.exe
  2⤵
  PID:9700
- C:\Windows\System\fpcftOd.exe
  C:\Windows\System\fpcftOd.exe
  2⤵
  PID:9716
- C:\Windows\System\YoeTVWk.exe
  C:\Windows\System\YoeTVWk.exe
  2⤵
  PID:9732
- C:\Windows\System\RKiQPvy.exe
  C:\Windows\System\RKiQPvy.exe
  2⤵
  PID:9748
- C:\Windows\System\UPyXsJV.exe
  C:\Windows\System\UPyXsJV.exe
  2⤵
  PID:9764
- C:\Windows\System\EFjeZHe.exe
  C:\Windows\System\EFjeZHe.exe
  2⤵
  PID:9780
- C:\Windows\System\WLlFQWh.exe
  C:\Windows\System\WLlFQWh.exe
  2⤵
  PID:9796
- C:\Windows\System\EvcuoBz.exe
  C:\Windows\System\EvcuoBz.exe
  2⤵
  PID:9820
- C:\Windows\System\KNRArLO.exe
  C:\Windows\System\KNRArLO.exe
  2⤵
  PID:9880
- C:\Windows\System\qLoJWHn.exe
  C:\Windows\System\qLoJWHn.exe
  2⤵
  PID:9896
- C:\Windows\System\tEVwSTe.exe
  C:\Windows\System\tEVwSTe.exe
  2⤵
  PID:9916
- C:\Windows\System\JXrzIgg.exe
  C:\Windows\System\JXrzIgg.exe
  2⤵
  PID:9940
- C:\Windows\System\umWiksP.exe
  C:\Windows\System\umWiksP.exe
  2⤵
  PID:9956
- C:\Windows\System\SRLWTKX.exe
  C:\Windows\System\SRLWTKX.exe
  2⤵
  PID:9972
- C:\Windows\System\xgNlZkt.exe
  C:\Windows\System\xgNlZkt.exe
  2⤵
  PID:9988
- C:\Windows\System\aFPrGgK.exe
  C:\Windows\System\aFPrGgK.exe
  2⤵
  PID:10004
- C:\Windows\System\AnorkNQ.exe
  C:\Windows\System\AnorkNQ.exe
  2⤵
  PID:10020
- C:\Windows\System\JTCAOvt.exe
  C:\Windows\System\JTCAOvt.exe
  2⤵
  PID:10036
- C:\Windows\System\AMKDjTd.exe
  C:\Windows\System\AMKDjTd.exe
  2⤵
  PID:10088
- C:\Windows\System\GKWUywE.exe
  C:\Windows\System\GKWUywE.exe
  2⤵
  PID:10108
- C:\Windows\System\GwWnkoi.exe
  C:\Windows\System\GwWnkoi.exe
  2⤵
  PID:10136
- C:\Windows\System\WVZMCni.exe
  C:\Windows\System\WVZMCni.exe
  2⤵
  PID:10152
- C:\Windows\System\EbALyWL.exe
  C:\Windows\System\EbALyWL.exe
  2⤵
  PID:10168
- C:\Windows\System\cCfcvJJ.exe
  C:\Windows\System\cCfcvJJ.exe
  2⤵
  PID:10184
- C:\Windows\System\HQTIsPW.exe
  C:\Windows\System\HQTIsPW.exe
  2⤵
  PID:8848
- C:\Windows\System\LHKevvg.exe
  C:\Windows\System\LHKevvg.exe
  2⤵
  PID:9180
- C:\Windows\System\rYpUqvD.exe
  C:\Windows\System\rYpUqvD.exe
  2⤵
  PID:9320
- C:\Windows\System\MmTFiZR.exe
  C:\Windows\System\MmTFiZR.exe
  2⤵
  PID:9084
- C:\Windows\System\JEXUImZ.exe
  C:\Windows\System\JEXUImZ.exe
  2⤵
  PID:9244
- C:\Windows\System\DooCRXs.exe
  C:\Windows\System\DooCRXs.exe
  2⤵
  PID:9276
- C:\Windows\System\UAiDwSD.exe
  C:\Windows\System\UAiDwSD.exe
  2⤵
  PID:9372
- C:\Windows\System\iXrgZzG.exe
  C:\Windows\System\iXrgZzG.exe
  2⤵
  PID:9404
- C:\Windows\System\tbObVOF.exe
  C:\Windows\System\tbObVOF.exe
  2⤵
  PID:9436
- C:\Windows\System\rVpumjz.exe
  C:\Windows\System\rVpumjz.exe
  2⤵
  PID:9452
- C:\Windows\System\UPTwDMh.exe
  C:\Windows\System\UPTwDMh.exe
  2⤵
  PID:9468
- C:\Windows\System\tbGUjhg.exe
  C:\Windows\System\tbGUjhg.exe
  2⤵
  PID:9508
- C:\Windows\System\xvVSchw.exe
  C:\Windows\System\xvVSchw.exe
  2⤵
  PID:9544
- C:\Windows\System\mrjHXzE.exe
  C:\Windows\System\mrjHXzE.exe
  2⤵
  PID:9588
- C:\Windows\System\GQSXhqD.exe
  C:\Windows\System\GQSXhqD.exe
  2⤵
  PID:9492
- C:\Windows\System\vFjXaHX.exe
  C:\Windows\System\vFjXaHX.exe
  2⤵
  PID:9676
- C:\Windows\System\pkzfxmr.exe
  C:\Windows\System\pkzfxmr.exe
  2⤵
  PID:9528
- C:\Windows\System\paPshpn.exe
  C:\Windows\System\paPshpn.exe
  2⤵
  PID:9740
- C:\Windows\System\JYYBEBj.exe
  C:\Windows\System\JYYBEBj.exe
  2⤵
  PID:9656
- C:\Windows\System\hgasOYV.exe
  C:\Windows\System\hgasOYV.exe
  2⤵
  PID:9888
- C:\Windows\System\akjAJKm.exe
  C:\Windows\System\akjAJKm.exe
  2⤵
  PID:9808
- C:\Windows\System\QzQytWD.exe
  C:\Windows\System\QzQytWD.exe
  2⤵
  PID:9924
- C:\Windows\System\BQIutJw.exe
  C:\Windows\System\BQIutJw.exe
  2⤵
  PID:9964
- C:\Windows\System\FbGzuKz.exe
  C:\Windows\System\FbGzuKz.exe
  2⤵
  PID:9904
- C:\Windows\System\Sgysxab.exe
  C:\Windows\System\Sgysxab.exe
  2⤵
  PID:9948
- C:\Windows\System\NYAjTMb.exe
  C:\Windows\System\NYAjTMb.exe
  2⤵
  PID:10016
- C:\Windows\System\RBbCOad.exe
  C:\Windows\System\RBbCOad.exe
  2⤵
  PID:9860
- C:\Windows\System\UgsEbGo.exe
  C:\Windows\System\UgsEbGo.exe
  2⤵
  PID:9844
- C:\Windows\System\JGZqCcX.exe
  C:\Windows\System\JGZqCcX.exe
  2⤵
  PID:9828
- C:\Windows\System\yBrRnFL.exe
  C:\Windows\System\yBrRnFL.exe
  2⤵
  PID:10164
- C:\Windows\System\ejSFmRQ.exe
  C:\Windows\System\ejSFmRQ.exe
  2⤵
  PID:10200
- C:\Windows\System\gVIXaMs.exe
  C:\Windows\System\gVIXaMs.exe
  2⤵
  PID:10224
- C:\Windows\System\WQYGWql.exe
  C:\Windows\System\WQYGWql.exe
  2⤵
  PID:9256
- C:\Windows\System\HzMoPQi.exe
  C:\Windows\System\HzMoPQi.exe
  2⤵
  PID:8776
- C:\Windows\System\VztWKrk.exe
  C:\Windows\System\VztWKrk.exe
  2⤵
  PID:8952
- C:\Windows\System\GyCcKLs.exe
  C:\Windows\System\GyCcKLs.exe
  2⤵
  PID:9324
- C:\Windows\System\XkPvbfu.exe
  C:\Windows\System\XkPvbfu.exe
  2⤵
  PID:9388
- C:\Windows\System\OONDhbi.exe
  C:\Windows\System\OONDhbi.exe
  2⤵
  PID:9340
- C:\Windows\System\dAUjdrg.exe
  C:\Windows\System\dAUjdrg.exe
  2⤵
  PID:9448
- C:\Windows\System\dHCPxyg.exe
  C:\Windows\System\dHCPxyg.exe
  2⤵
  PID:9520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AXPBHeh.exe

Filesize
1.8MB

MD5
e51e593a286c73c7b52c6c92fbf18e4c

SHA1
e947c27f546a6dd5b2cb597aa6f5814026af5893

SHA256
78b534c82c4be74c5cd818cc78e88415c949afc92757da072bb3ad0f4bbc9b53

SHA512
db91cf91194946438674208c8b870ec40988d461142cdaaa79571a4bb33c00b95f0e45fc817180dd286277f31b8853accc8c3a4810a6352c5f09322dfcd3e416

Download Submit
C:\Windows\system\CDfARot.exe

Filesize
1.8MB

MD5
01134d9adc10da58641562364f88fe28

SHA1
8704994453a9f066c845f7dbf00a8bb642e25b46

SHA256
8485699513c5765db40bbbeff5354299dc5a53828e550fa9884c67dc6cf5f7c7

SHA512
74dfa234283f82724da5fcd5e6e2a2b164a29197a9450af1440a4117c96b88f5b090e533d8613b47992397bac485be0f4274ed6c4826131b84fb50ef5e47fb84

Download Submit
C:\Windows\system\CGOMKdf.exe

Filesize
1.8MB

MD5
759eccc0ab94ddc7eac69a55ee28c3bd

SHA1
a5d059f7c03a990bb486702d4cfa2868bb0b68f0

SHA256
3fe564a5d1adc1b5598c66825ac17582d92e3eb9b99ab184b0c41144aef28c9b

SHA512
c911419efb8aa63cd6b8bb01554f94a6ea617e5bc8065bf4d60e016e74e3044faa3d77d9c25afcb02bdfcb5186f4f5020c91b516773ba074724e470d528afaf5

Download Submit
C:\Windows\system\DBxhGAB.exe

Filesize
1.8MB

MD5
61e6c0dc95b8c65de11169a665ef21c0

SHA1
1d5a2c3c133cc6a7ac34f2dc514f1e085130a3d3

SHA256
1260b4186a167638f0eed53a572b55a5020ae50c96da633b8c98104d82c47823

SHA512
914391c7641ae36e261896a9fe46d5372dbb21cbdd9454f53941f34d1962a616bc8ddc5e3e0478001c1987503e7201c1690b286653f8525bfcea56b1586a3dd7

Download Submit
C:\Windows\system\DCFgPDu.exe

Filesize
1.8MB

MD5
01e85841414e196056fba5efde33a84e

SHA1
df618d9363a4a40a1b9d0148d8bc414061090d36

SHA256
5e73db7abb6892dfdf30df5a935d304fe82f2e4917385c038d88b72d2a1f4dbe

SHA512
6e91fbb7e1e9b0cda66b50b21b1e4f8cc4f12c9e6111bfc969cd2a77247ed1ddc5004c4c47ed28fa7cbcfb30ea142da08c985c29b285548aaad83d421d4c1872

Download Submit
C:\Windows\system\FSeFgFA.exe

Filesize
1.8MB

MD5
c0a1afab3b93cf46514812b04aed1fa0

SHA1
239590f9c697d1da001238e8d655b83f439e2964

SHA256
285d993cd3830581f6965434fba5e606d8ee11112bce6bbd46a1c7696953eb01

SHA512
35a9c32946ef1158dbc5728ae4de5d17659ac538ca8ccd404e0729a74cfc02e83f1ab3a5acc8de7445c3aa04929f74d3a81e39c6edb7bf92f181ed95664fb8a2

Download Submit
C:\Windows\system\GSrfQie.exe

Filesize
1.8MB

MD5
2f3d4882ab6cd4ac537e3dfb337174e6

SHA1
e9f504ce0631f3ae5287715fb81918369d91fc17

SHA256
31aa0340ea5d967e8e1d0bee372875c1acfcac6d97b7fc044f75266b837426c9

SHA512
0113949c01618aef3e332a5065c58c787b9dd2a780059223368d5ae240af54f9a575ed5d45f92f5fffdda27a7b18a4b96420f8db94072aeae878e8a44a1dd165

Download Submit
C:\Windows\system\NFedEzF.exe

Filesize
1.8MB

MD5
7e748ca77b208a1a2a740fa5b9792f20

SHA1
5f402a028ac487492bdf79e2639dd3cc6f74413d

SHA256
dfdd14027dc0f8f00d015f74e7127cca1bf37ca47029805d9650ee5ea0c1c5c4

SHA512
6863b67840acacb73b2df2b7c119786d345ca62d920ebbc6b512a17f270cd818f6d667dd2aaa20d9d5be8a8008e3bbfcdd009f5926e565af3eccc21c5a5a2fde

Download Submit
C:\Windows\system\OELnFod.exe

Filesize
1.8MB

MD5
c1f8932b0f1915c288dc0d42d209094b

SHA1
c1d9a8fba2e7481257e7d05bb05c1345b42a02cf

SHA256
cc9ed69ccb658e596e519a027631abf6110143ded3384e7880d73ef3455c88ff

SHA512
1d652210a8b2b1ec0370f5cc6393e7a9e0f8261d3a80847d9d7cfad914c5042781ec568ea33529874fd70daae1868e6a0c8954416680f28bec9dd709eb2107a7

Download Submit
C:\Windows\system\OZzscJw.exe

Filesize
1.8MB

MD5
f39f4f471b517e9840f9d164a2e6e9cb

SHA1
7d234512c922f155b4dde27aab353d7f4e956f9e

SHA256
b15915a395b46f63d37031ccba4abc9a9e8cfe6eb104e25aa6473da0898cf4d2

SHA512
80e1a25abd2c5b756a4345f30cf75f2e3a6912653d796bebe8b05c695bc8771d9ad07009054980e6c735af7117912a92b14cbda69498d9dfca5d6c87851ecb4c

Download Submit
C:\Windows\system\ROgPziQ.exe

Filesize
1.8MB

MD5
7fb47f910d60ea477d0e1dc89fde02d1

SHA1
312ac9c3d5b654d91df9b8a3e22c5c8e5e5bb12c

SHA256
52fa1d9e3b6581dc705ca8682e69ffa9809b9d85420144d38b2df2dd9082da90

SHA512
e6baf260196545e4ac6b06f726043985502ba95b8da84b417be9a1da76365103c372d2765f9a0e350407352137174e7b0608a617e361eca2211930cf736aea69

Download Submit
C:\Windows\system\SXVWWdk.exe

Filesize
1.8MB

MD5
43a7e81437d333b1840250f7f06de374

SHA1
3023f9261d5bb03a3034b0c089ddbc33bef9d6d5

SHA256
bbb9cf1068f986a70b83127c59f52b8df3bdd718fd44ea715783ee9aa9e28fa9

SHA512
4ff4d7b70f63f274d1341660a33cf363db4223bce7ce76d30444f34b3fa09395f3130b19dcd534cc77ac4056b0f2a405a6eb6a33d1f69cc111575c56161a0897

Download Submit
C:\Windows\system\UTbQMIH.exe

Filesize
1.8MB

MD5
0104b7454125f2b8bb695cb99c0bf0ac

SHA1
f50871bf56268372ffde64c3e4f7a9736b38e24d

SHA256
b85b940b66212815176702617d981cb49eaef39058fd18143be6afb97138e217

SHA512
aed525ad455102896ae26e6f27c0928a39ac27d51296ddf9739fd2a35c39cee7ae5b0ae8be0c46d6de464ad23e2d81ba120c8f77c4807ad4ab0d8dc1f1b030a7

Download Submit
C:\Windows\system\UdkcaHE.exe

Filesize
1.8MB

MD5
b700d62ace354705a35c326be5485012

SHA1
8148a0032a92c6a7b71e39e31fef7a7c02a9de98

SHA256
d417336e622b0e57454d5e4208eba55e5a7c25649b1e92590423d3955da9012d

SHA512
27f60df773e52546443f9693ee39f4fceeb1d5941fa9937859ef55aa912b6305ee20f79ab57a498b4ecc0c28741a7d2bcdcd12125e6b1bf84491e0f532f3dc7f

Download Submit
C:\Windows\system\WaxESPA.exe

Filesize
1.8MB

MD5
b5e0be1cd6a37fda9738de8c241995e1

SHA1
eed7b6a2023e10eb0e4f1f0fab50a12440bb72ab

SHA256
43f8c6dfb46fb12eda1051dd94632c0c1ad6c417e975130c47a83a9679ecfe09

SHA512
0c5385046714632cacbde251c60ca15ace405b4dc39163c0f7e568086b9475d54490c13ad47ca8cbf23eaa12dd4e8a2d8ad759441ccb99bc928414e49eafbd11

Download Submit
C:\Windows\system\WucPNQV.exe

Filesize
1.8MB

MD5
78525f1244bcec624860f5a85403a254

SHA1
17163841fb74ef552a4cbbe9eb769b68fbe7e0cc

SHA256
92cda8242482430ee5df6aa6cd93269bf8babd258d5e3b67dcc31fb0c1a27832

SHA512
79188f0fc84a2cb2c2ea65780d2b2322ff5171bc4c9288c78dea02de604b4d19a8663b3c7b6ac95cdf24d91a15d9c2f010f2a194ae458a4af5041f7ad07c4b42

Download Submit
C:\Windows\system\ZHCchBD.exe

Filesize
1.8MB

MD5
6be948abc22520f292349cfe955b569b

SHA1
54469deea045101f09ac53d22669955455906fd0

SHA256
009a60cf4e28157b655ff15acfd7a4fb4ad0c7dd48172488f5d47acca1f40d6f

SHA512
5c909fc01e634a224a99f610c4bf9bc63d4be79a6d020efa6195276f71d45388cb794b3478fd83c8242d9c4a8384c41f6f01269b786756ca0db22c23b78014ba

Download Submit
C:\Windows\system\baxzxks.exe

Filesize
1.8MB

MD5
c9763827b67fa09bbd21e8a597d2e4ba

SHA1
dd80063be3259e52dc492c5ce70b87c7a8660853

SHA256
c958d1ef40479cb94cdd9b41bf60c542221f800f610fd62bcfe1c40bf70a1df7

SHA512
02c45c01e56a2cf1f8c5b4214730aaab68dab94c7dd41200372dee0ea7a6aa456853e754b3df9bf2bb8b19fbeab157092782067c762a289096f02e298eb457e7

Download Submit
C:\Windows\system\cPMRyCk.exe

Filesize
1.8MB

MD5
7ae1c9416c5a40d6611de49efeef8be7

SHA1
b7ab9a631f463900968d9e9b48650135eef42fa7

SHA256
7eafe6f7d574fb074720052dbe9e9d58827ae6636ef4d07382276c7c48061859

SHA512
4d075009fb741b26337955f0b921f870f40ba3805c0a0238d142b0085d6cce19bc6f2eea7c5c1df6cfbc2d64d7ed46a3b8529cf7603a6e2077ba01ccb52c05eb

Download Submit
C:\Windows\system\cdYyYwJ.exe

Filesize
1.8MB

MD5
70e25cbf6b35e37a982864a617cec14e

SHA1
d21be6021f85ff664b0ed3712d3cca9a596d7a4e

SHA256
c6d1aedfcc957ea60f50836780adf266f54d4e5badf70fac1f20a998a592e492

SHA512
261b14056a0bc8397342bfced55bd6c4d3b4a8df0972bc4e24f24fde0dffb8ce4616344ace498a54f0bb6670fc3ee357ab2574576b44cfa5f90e988c20e95b83

Download Submit
C:\Windows\system\ejJQGHN.exe

Filesize
1.8MB

MD5
2c92c9ad3109e32512ed5cb665a7712b

SHA1
c0c0965f6c9519229a687f992b9101ee598d18b7

SHA256
80c7ce7ab9625a298323f8bca7cef188af016d63575e7b16480be486415552f2

SHA512
69a1552f6b5fbabe388bd3ce338d460640caa14c5d50c3e2caa4398dd87d06cf498af6fd5234c20d61ff1141a29f9b2f067e09dea51aaaa8ea35d4871ad4a82c

Download Submit
C:\Windows\system\fcBcuOU.exe

Filesize
1.8MB

MD5
d9884610a30311b4e16a1369f4f19d07

SHA1
30c09b4391dc7b81b4418d653526b2b15aa2d7f8

SHA256
71006379cde8bfd5c92c234d09debd7e5f0f85cb7f550bbf31696b6aa8aa2aaa

SHA512
394b72135bf59e048d7dbcba5287f789f76211565be9de8538f0b70ba788b28c142db66d6b902cb5c12cd17c97ec3546b630042e5d7656af66a9464631ab707e

Download Submit
C:\Windows\system\gPrOjCB.exe

Filesize
1.8MB

MD5
4c48426953df3e3015f298834b1cbebd

SHA1
be992286e11a96fbd365de0d3a74f8c70768481f

SHA256
7ea0045d1363d2898485d916d181de12624aef32b7516ae9ac80c942bc8ded9b

SHA512
4c5228d75e69335f38b457a99c5985c953185908fb5053029dfcbfc104da4cf476beed1d0f1d0e77b15f6c952db402d18c491c1bf36ea828689da8818be94100

Download Submit
C:\Windows\system\lRdjhUY.exe

Filesize
1.8MB

MD5
8f1edfce98a618b067d668452a29eaee

SHA1
46409e1260253860d081104517f52488c486c155

SHA256
6937367eec52d0c47d7a53af04468185be806c2e89eb514bb404b7702c8274e9

SHA512
1df633eeefeba0aa992b4b4cb5eb307394e3d5c71ac540e26b793eb6450a6ea46dd872b71c35e68e24676c07d923936e45ea6b8d082a152dfb04603db7010fbf

Download Submit
C:\Windows\system\llapIkO.exe

Filesize
1.8MB

MD5
078b8df8d43d48057d4ff0726399e8ef

SHA1
493f4f1496344ad272aa6204366af5974f7f8299

SHA256
de22a3948a6d281ec30da7a5d7742999a9dd7392cf3b709fda6934fef19c1642

SHA512
ccec7e01cd3f28d50584d25c3348498ddc303d53f1bac757a724b2f62c7bfb97cba672279d6d587cf2d610fe6dac0353d575bcd53ca9e5c29c63506b12a9a6cb

Download Submit
C:\Windows\system\lvDlXpu.exe

Filesize
1.8MB

MD5
5c76aa79488031887b9a794c6285247b

SHA1
09afc13e672ae08325eba4401aa0ef9ea445bb93

SHA256
35033038e117199f82091c39fa4e491e86b434bdbb6aa42ed7448016ff6a0cd3

SHA512
9805498d4d9b7f2ccca31fd31c30ceeffc4c1a63d89565f7470d7810aa6fe18e4e69b8e1ff43ffb3c8c5af531789d658ac36676880aa7f491ad0301e1ee97b31

Download Submit
C:\Windows\system\mqRzmSw.exe

Filesize
1.8MB

MD5
3e6282aa65c946cf7644390086a0a7fb

SHA1
b3eb0e1254b7ae829fbc2da8a2cf7ddf4876e57e

SHA256
a7bedbca9801ad9d9eb56b2c56942f3af25cbce2d0cabf4188928d6812f67536

SHA512
8112c2aad016a4e710a11eb13b67650c249932e52cbb18a365de8464aed86e36de20a5c6cab919d4c49bbbcc9d6d11feeb33b929859b41025866f3b8a9337803

Download Submit
C:\Windows\system\ppfEcaE.exe

Filesize
1.8MB

MD5
4c33175dc7e6c2086ed5117a0797aebf

SHA1
a2d5257b7638e49710e48c23349503331d7fe3f3

SHA256
751a0a6a28f0c5a1d701b94b9874aba2523f07336f0def3740e49459e54884bb

SHA512
923f3a07da8d01e8ab70fb2b0c66bce3516998937dc40ed263911bb94b7ebfc54606df1d2cd66c70db3cb50cc45ba77689d8f6fe16bbe78b42e86e6981758e3f

Download Submit
C:\Windows\system\wVWscTw.exe

Filesize
1.8MB

MD5
eca48fd102491a83fb5816386f0ecde3

SHA1
78ba205372111ac01803658387d55d8693667175

SHA256
b02b2d1e954f43833abda36fb7ecaf379e2be30f05274378d12d63e8d35fe0e9

SHA512
d62c1b36220d8afc930908b7ed49dab4cb3b09a34f6685fd6dfa7aa2e6305ffd16e1df523080d2dfe49a0d41ab3b1efa5919acb9fd598b43a7bfdb2f9f9b608a

Download Submit
C:\Windows\system\wXshaNg.exe

Filesize
1.8MB

MD5
77b7690af096590681f0daad4eaee7b0

SHA1
f7b0736c77a0612c15e27456e091a1933420510d

SHA256
77fb8acc58a101ecbc6687f383f2de0aa3ec93446386629a333616b8828a1db0

SHA512
72c949d3499282e5d25b83c14c3b5142e707cbf3b3ed3f47db1b78d81c5226f026e81d757ffcfaea43f8eeea03dbdce242561c4864aeb70c798d050e309f3476

Download Submit
\Windows\system\GKNyBtZ.exe

Filesize
1.8MB

MD5
aec1fbc7517e65d2885545c77e0613a6

SHA1
653a694207c163a8ac1825f9e123f6447952f942

SHA256
b9433f720697e01f8a984088b71e8fae5c54eabc8b02333dee2d9712a89fbc0b

SHA512
8754f174b028f1e426d10fa664dc4ad908c7dfdfc4b1d6b3017249bffb782154ae02918041f8dcba3e92cf5edadd3d7301e5fe7ef0f36cfe0d7784b636c5c2a1

Download Submit
\Windows\system\QldHmRa.exe

Filesize
1.8MB

MD5
a9bd84c576b5dcfd7875221b3135f225

SHA1
23cf364986c5a247f5fd2b3c551c33f4997cc26a

SHA256
0603531bc8740de2b26ebd059927636ad7d84fd7950c574ba8e47271da4d3b3b

SHA512
6f36fd72a546b3e529c28d8dcb124d393a948e9e3a26a4b0f864e57e84723e8d1a1cee4fd6dad5b470b4e254ecc61f7b7ef3a8d871347b06642aba36bb45fe58

Download Submit
\Windows\system\zkXpnyU.exe

Filesize
1.8MB

MD5
fb3b3b12cda7849515baaa5804bd1c07

SHA1
dc81c9ad62ed898cc508ff5e13feb13a407ac697

SHA256
ef113c9a090e8475d4a8c33f00843a03188f1bc2ed7d6abdbf48b69f72a05e6b

SHA512
e1fcfa9417d8a83b8da8f61ceb0dc07aa6ff812ea3b59e563e6f865388076e0e5539f63a9c6d95c9686ec7f3794e698184fa463a3b36f9b2eacacbd0720c84e9

Download Submit
memory/1296-3707-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/1296-33-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-263-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/1936-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1936-0-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/1936-288-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/1936-29-0x0000000002670000-0x0000000002A62000-memory.dmp

Filesize
3.9MB

Download
memory/1936-37-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/1936-40-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/1936-284-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/1936-266-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-272-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-268-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-271-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2508-264-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2508-3724-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2584-161-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/2584-254-0x0000000002240000-0x00000000022C0000-memory.dmp

Filesize
512KB

Download
memory/2584-157-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/2584-253-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/2584-262-0x0000000002240000-0x00000000022C0000-memory.dmp

Filesize
512KB

Download
memory/2584-261-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/2584-812-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/2596-255-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2596-3705-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2616-267-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-3731-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-3704-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2644-42-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2656-3732-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2656-265-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2676-270-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2676-3915-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2704-285-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-3711-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-3795-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-269-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download