xmrig | 5eee6d2cb01cb441760520310c95e468959803a454d88060e780aa6b3b50a9c9

Analysis

max time kernel
53s
max time network
37s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
Size

2.1MB
MD5

0b37ffb65002bec4638d65e4dde38d74
SHA1

207840d993fe86c1d3a2943e32d9456b1cdf65c4
SHA256

5eee6d2cb01cb441760520310c95e468959803a454d88060e780aa6b3b50a9c9
SHA512

1196f9b82b589046063cbefef48b8568ca695df108aec3401b05c784833110174e998286faa9a0cf1a7c1b117c294700bc2e0e76986efc2c81be95b0afed982a
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr4:NABx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2988-238-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/3004-236-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2464-218-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2396-208-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2440-198-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/848-180-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2600-19-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2692-16-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/3004-3613-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/848-3616-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2396-3615-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2600-3617-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2988-3628-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2440-3627-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2692-3631-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2464-3624-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2700-3623-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2600	FmDmgZX.exe
2692	IFHmjoW.exe
2700	hTDPMJr.exe
848	YsyAxEu.exe
2440	jWumnaU.exe
2396	pxiPCAr.exe
2464	ZmibNPx.exe
3004	CIXhVoC.exe
2988	ejrzsxP.exe
2480	BYIzJam.exe
2792	moGVwRf.exe
2812	NnyZYWv.exe
1904	DRnoWpl.exe
1476	SsNcmkT.exe
2284	EQlyKVV.exe
1516	PtRHPoM.exe
2580	wtzCKMm.exe
1856	xLFhfGK.exe
2736	aeidEaY.exe
2748	qbxesro.exe
692	vOvPQEN.exe
616	wCFayIH.exe
1016	bYiKNJw.exe
2212	ZXOPGsC.exe
2080	EtbUNEz.exe
1932	tDcnPfB.exe
1176	CjybSJq.exe
1616	odwdcTy.exe
988	sDXitZr.exe
1424	yzfevgq.exe
1720	SScrMyp.exe
1404	kLMOfTx.exe
1164	SnhkqdA.exe
1960	gMSQggr.exe
2160	gvmRfKZ.exe
1004	ZKIaJAh.exe
952	uCQTHuL.exe
1776	tePOZBo.exe
108	hFRlKYs.exe
904	FXfJeYt.exe
2252	kaYDcXS.exe
2364	olnpdfO.exe
1172	WIMDUOH.exe
1512	YNBrnGt.exe
2876	yKOYpqR.exe
1068	GmmDwuP.exe
1036	QYkEhfI.exe
2544	SxWecAJ.exe
2232	XYkdRbL.exe
3016	ovvTNOA.exe
2148	TqqIStV.exe
980	JMoIUsx.exe
2344	IwfNjrr.exe
2552	bRyhYci.exe
2416	CIRWmPV.exe
2556	tcwSSUB.exe
1632	AHBAPmJ.exe
2424	JcEbcpC.exe
3052	dbfqisK.exe
1680	FCXKQPL.exe
2824	xZJhDPO.exe
2920	KpuedXY.exe
1444	ljGzJBY.exe
2764	eyPqtGm.exe

Loads dropped DLL 64 IoCs

pid	Process
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2328-1-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/files/0x00080000000122cd-3.dat	upx
behavioral1/files/0x0008000000015ca6-20.dat	upx
behavioral1/memory/2700-26-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/files/0x003600000001566b-11.dat	upx
behavioral1/files/0x0008000000015cba-31.dat	upx
behavioral1/files/0x00060000000161e7-55.dat	upx
behavioral1/files/0x00060000000164b2-65.dat	upx
behavioral1/files/0x000600000001661c-75.dat	upx
behavioral1/files/0x0006000000016843-78.dat	upx
behavioral1/files/0x0006000000016c4a-90.dat	upx
behavioral1/files/0x0006000000016ce4-110.dat	upx
behavioral1/files/0x003400000001567f-130.dat	upx
behavioral1/files/0x0006000000016eb2-169.dat	upx
behavioral1/memory/2988-238-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/3004-236-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2464-218-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2396-208-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2440-198-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/848-180-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/files/0x0006000000016dbf-157.dat	upx
behavioral1/files/0x0006000000016da7-150.dat	upx
behavioral1/files/0x0006000000016d7e-142.dat	upx
behavioral1/files/0x0006000000016e94-164.dat	upx
behavioral1/files/0x0006000000016dbb-155.dat	upx
behavioral1/files/0x0006000000016d90-147.dat	upx
behavioral1/files/0x0006000000016d3a-135.dat	upx
behavioral1/files/0x0006000000016d26-126.dat	upx
behavioral1/files/0x0006000000016d1e-120.dat	upx
behavioral1/files/0x0006000000016d0d-115.dat	upx
behavioral1/files/0x0006000000016cb7-105.dat	upx
behavioral1/files/0x0006000000016c6b-100.dat	upx
behavioral1/files/0x0006000000016c63-95.dat	upx
behavioral1/files/0x0006000000016a9a-85.dat	upx
behavioral1/files/0x0006000000016572-70.dat	upx
behavioral1/files/0x000600000001630b-60.dat	upx
behavioral1/files/0x0008000000016117-50.dat	upx
behavioral1/files/0x0008000000015ceb-40.dat	upx
behavioral1/files/0x0007000000015d07-46.dat	upx
behavioral1/files/0x0007000000004e76-36.dat	upx
behavioral1/memory/2600-19-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2692-16-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/3004-3613-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/848-3616-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2396-3615-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2600-3617-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2988-3628-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2440-3627-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2692-3631-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2464-3624-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2700-3623-0x000000013F250000-0x000000013F642000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bsjNrFw.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\fnGsGlp.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\mVxKIsS.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\BVrMHQI.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\LZUYhDB.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\SPTqILv.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\NnyZYWv.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\TutKtGn.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\vqISqsv.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\sJjCpoe.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\FCsAjrC.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\uCxZmOu.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\EszzftN.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\LYJuHJo.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\QCgNJxE.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\eATDjUu.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\KpuedXY.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\qFkprml.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\YAaTTkI.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\AtIimDG.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\EyfSEpa.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\wzgFZgI.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\jsudpBe.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\AdaUMSE.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\hvKFyZN.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\wOqKDxF.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\smcKJVs.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\cvKyXHx.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\ojPqoqA.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\AxrtjVR.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\veyTHgG.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\bIfWaBr.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\KNDPzTL.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\dbDhcBN.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\wslyRJB.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\iNyxyAj.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\zoNDejG.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\PlOWkgD.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\jxJaZFE.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\KZFralg.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\pbvxreJ.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\yITxcYv.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\TFEliZw.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\unoWpVS.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\MVXeVZA.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\cLEQMEc.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\WVRgqFg.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\CGxVZZd.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\MIueQZb.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\IvLUQEN.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\rbjeyDv.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\NraKusm.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\OFkyFiR.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\UdamZGq.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\IMDIlbZ.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\pVBdDsg.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\qdeJYTF.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\sqLARQM.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\iPwBCty.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\cCKumvA.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\dUYJhcN.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\JcEbcpC.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\ZRpuDnZ.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
File created	C:\Windows\System\upYbaDg.exe	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2500	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
Token: SeDebugPrivilege	2500	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2500	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	29
PID 2328 wrote to memory of 2500	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	29
PID 2328 wrote to memory of 2500	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	29
PID 2328 wrote to memory of 2600	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2600	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2600	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2692	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	31
PID 2328 wrote to memory of 2692	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	31
PID 2328 wrote to memory of 2692	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	31
PID 2328 wrote to memory of 2700	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	32
PID 2328 wrote to memory of 2700	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	32
PID 2328 wrote to memory of 2700	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	32
PID 2328 wrote to memory of 848	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	33
PID 2328 wrote to memory of 848	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	33
PID 2328 wrote to memory of 848	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	33
PID 2328 wrote to memory of 2440	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	34
PID 2328 wrote to memory of 2440	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	34
PID 2328 wrote to memory of 2440	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	34
PID 2328 wrote to memory of 2396	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	35
PID 2328 wrote to memory of 2396	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	35
PID 2328 wrote to memory of 2396	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	35
PID 2328 wrote to memory of 2464	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	36
PID 2328 wrote to memory of 2464	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	36
PID 2328 wrote to memory of 2464	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	36
PID 2328 wrote to memory of 3004	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	37
PID 2328 wrote to memory of 3004	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	37
PID 2328 wrote to memory of 3004	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	37
PID 2328 wrote to memory of 2988	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	38
PID 2328 wrote to memory of 2988	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	38
PID 2328 wrote to memory of 2988	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	38
PID 2328 wrote to memory of 2480	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	39
PID 2328 wrote to memory of 2480	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	39
PID 2328 wrote to memory of 2480	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	39
PID 2328 wrote to memory of 2792	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	40
PID 2328 wrote to memory of 2792	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	40
PID 2328 wrote to memory of 2792	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	40
PID 2328 wrote to memory of 2812	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	41
PID 2328 wrote to memory of 2812	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	41
PID 2328 wrote to memory of 2812	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	41
PID 2328 wrote to memory of 1904	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	42
PID 2328 wrote to memory of 1904	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	42
PID 2328 wrote to memory of 1904	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	42
PID 2328 wrote to memory of 1476	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	43
PID 2328 wrote to memory of 1476	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	43
PID 2328 wrote to memory of 1476	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	43
PID 2328 wrote to memory of 2284	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	44
PID 2328 wrote to memory of 2284	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	44
PID 2328 wrote to memory of 2284	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	44
PID 2328 wrote to memory of 1516	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	45
PID 2328 wrote to memory of 1516	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	45
PID 2328 wrote to memory of 1516	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	45
PID 2328 wrote to memory of 2580	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	46
PID 2328 wrote to memory of 2580	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	46
PID 2328 wrote to memory of 2580	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	46
PID 2328 wrote to memory of 1856	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	47
PID 2328 wrote to memory of 1856	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	47
PID 2328 wrote to memory of 1856	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	47
PID 2328 wrote to memory of 2736	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	48
PID 2328 wrote to memory of 2736	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	48
PID 2328 wrote to memory of 2736	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	48
PID 2328 wrote to memory of 2748	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	49
PID 2328 wrote to memory of 2748	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	49
PID 2328 wrote to memory of 2748	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	49
PID 2328 wrote to memory of 692	2328	0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b37ffb65002bec4638d65e4dde38d74_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System\FmDmgZX.exe
  C:\Windows\System\FmDmgZX.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\IFHmjoW.exe
  C:\Windows\System\IFHmjoW.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\hTDPMJr.exe
  C:\Windows\System\hTDPMJr.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\YsyAxEu.exe
  C:\Windows\System\YsyAxEu.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\jWumnaU.exe
  C:\Windows\System\jWumnaU.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\pxiPCAr.exe
  C:\Windows\System\pxiPCAr.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\ZmibNPx.exe
  C:\Windows\System\ZmibNPx.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\CIXhVoC.exe
  C:\Windows\System\CIXhVoC.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\ejrzsxP.exe
  C:\Windows\System\ejrzsxP.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\BYIzJam.exe
  C:\Windows\System\BYIzJam.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\moGVwRf.exe
  C:\Windows\System\moGVwRf.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\NnyZYWv.exe
  C:\Windows\System\NnyZYWv.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\DRnoWpl.exe
  C:\Windows\System\DRnoWpl.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\SsNcmkT.exe
  C:\Windows\System\SsNcmkT.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\EQlyKVV.exe
  C:\Windows\System\EQlyKVV.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\PtRHPoM.exe
  C:\Windows\System\PtRHPoM.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\wtzCKMm.exe
  C:\Windows\System\wtzCKMm.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\xLFhfGK.exe
  C:\Windows\System\xLFhfGK.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\aeidEaY.exe
  C:\Windows\System\aeidEaY.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\qbxesro.exe
  C:\Windows\System\qbxesro.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\vOvPQEN.exe
  C:\Windows\System\vOvPQEN.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\wCFayIH.exe
  C:\Windows\System\wCFayIH.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\bYiKNJw.exe
  C:\Windows\System\bYiKNJw.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\ZXOPGsC.exe
  C:\Windows\System\ZXOPGsC.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\EtbUNEz.exe
  C:\Windows\System\EtbUNEz.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\tDcnPfB.exe
  C:\Windows\System\tDcnPfB.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\CjybSJq.exe
  C:\Windows\System\CjybSJq.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\yzfevgq.exe
  C:\Windows\System\yzfevgq.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\odwdcTy.exe
  C:\Windows\System\odwdcTy.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\SScrMyp.exe
  C:\Windows\System\SScrMyp.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\sDXitZr.exe
  C:\Windows\System\sDXitZr.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\kLMOfTx.exe
  C:\Windows\System\kLMOfTx.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\SnhkqdA.exe
  C:\Windows\System\SnhkqdA.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\gMSQggr.exe
  C:\Windows\System\gMSQggr.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\gvmRfKZ.exe
  C:\Windows\System\gvmRfKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\hFRlKYs.exe
  C:\Windows\System\hFRlKYs.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\ZKIaJAh.exe
  C:\Windows\System\ZKIaJAh.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\YNBrnGt.exe
  C:\Windows\System\YNBrnGt.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\uCQTHuL.exe
  C:\Windows\System\uCQTHuL.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\GmmDwuP.exe
  C:\Windows\System\GmmDwuP.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\tePOZBo.exe
  C:\Windows\System\tePOZBo.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\QYkEhfI.exe
  C:\Windows\System\QYkEhfI.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\FXfJeYt.exe
  C:\Windows\System\FXfJeYt.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\XYkdRbL.exe
  C:\Windows\System\XYkdRbL.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\kaYDcXS.exe
  C:\Windows\System\kaYDcXS.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\ovvTNOA.exe
  C:\Windows\System\ovvTNOA.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\olnpdfO.exe
  C:\Windows\System\olnpdfO.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\TqqIStV.exe
  C:\Windows\System\TqqIStV.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\WIMDUOH.exe
  C:\Windows\System\WIMDUOH.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\JMoIUsx.exe
  C:\Windows\System\JMoIUsx.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\yKOYpqR.exe
  C:\Windows\System\yKOYpqR.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\IwfNjrr.exe
  C:\Windows\System\IwfNjrr.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\SxWecAJ.exe
  C:\Windows\System\SxWecAJ.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\bRyhYci.exe
  C:\Windows\System\bRyhYci.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\CIRWmPV.exe
  C:\Windows\System\CIRWmPV.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\tcwSSUB.exe
  C:\Windows\System\tcwSSUB.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\AHBAPmJ.exe
  C:\Windows\System\AHBAPmJ.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\JcEbcpC.exe
  C:\Windows\System\JcEbcpC.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\dbfqisK.exe
  C:\Windows\System\dbfqisK.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\FCXKQPL.exe
  C:\Windows\System\FCXKQPL.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\xZJhDPO.exe
  C:\Windows\System\xZJhDPO.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\KpuedXY.exe
  C:\Windows\System\KpuedXY.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\ljGzJBY.exe
  C:\Windows\System\ljGzJBY.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\eyPqtGm.exe
  C:\Windows\System\eyPqtGm.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\RXMlRDl.exe
  C:\Windows\System\RXMlRDl.exe
  2⤵
  PID:1240
- C:\Windows\System\GJCAeOB.exe
  C:\Windows\System\GJCAeOB.exe
  2⤵
  PID:1452
- C:\Windows\System\daqhtQJ.exe
  C:\Windows\System\daqhtQJ.exe
  2⤵
  PID:2672
- C:\Windows\System\wdtThGn.exe
  C:\Windows\System\wdtThGn.exe
  2⤵
  PID:1860
- C:\Windows\System\jYmdZqH.exe
  C:\Windows\System\jYmdZqH.exe
  2⤵
  PID:328
- C:\Windows\System\dlgRzWB.exe
  C:\Windows\System\dlgRzWB.exe
  2⤵
  PID:1568
- C:\Windows\System\jsudpBe.exe
  C:\Windows\System\jsudpBe.exe
  2⤵
  PID:2972
- C:\Windows\System\hRrwYgM.exe
  C:\Windows\System\hRrwYgM.exe
  2⤵
  PID:2980
- C:\Windows\System\GnUnpiD.exe
  C:\Windows\System\GnUnpiD.exe
  2⤵
  PID:2604
- C:\Windows\System\mPljZnF.exe
  C:\Windows\System\mPljZnF.exe
  2⤵
  PID:2508
- C:\Windows\System\kHIFCOq.exe
  C:\Windows\System\kHIFCOq.exe
  2⤵
  PID:2944
- C:\Windows\System\GsOFHOX.exe
  C:\Windows\System\GsOFHOX.exe
  2⤵
  PID:2816
- C:\Windows\System\PVqcxOF.exe
  C:\Windows\System\PVqcxOF.exe
  2⤵
  PID:2968
- C:\Windows\System\hfaKOfy.exe
  C:\Windows\System\hfaKOfy.exe
  2⤵
  PID:840
- C:\Windows\System\sMIAMta.exe
  C:\Windows\System\sMIAMta.exe
  2⤵
  PID:816
- C:\Windows\System\FCaWNcB.exe
  C:\Windows\System\FCaWNcB.exe
  2⤵
  PID:1896
- C:\Windows\System\GOzwWxC.exe
  C:\Windows\System\GOzwWxC.exe
  2⤵
  PID:2688
- C:\Windows\System\JSjBuCP.exe
  C:\Windows\System\JSjBuCP.exe
  2⤵
  PID:2852
- C:\Windows\System\zHtWiMK.exe
  C:\Windows\System\zHtWiMK.exe
  2⤵
  PID:1724
- C:\Windows\System\SfUmiSx.exe
  C:\Windows\System\SfUmiSx.exe
  2⤵
  PID:1116
- C:\Windows\System\gfYiUJl.exe
  C:\Windows\System\gfYiUJl.exe
  2⤵
  PID:708
- C:\Windows\System\aTNTRxr.exe
  C:\Windows\System\aTNTRxr.exe
  2⤵
  PID:2092
- C:\Windows\System\osFxRTF.exe
  C:\Windows\System\osFxRTF.exe
  2⤵
  PID:1468
- C:\Windows\System\Cjgogae.exe
  C:\Windows\System\Cjgogae.exe
  2⤵
  PID:1916
- C:\Windows\System\YDvVqJy.exe
  C:\Windows\System\YDvVqJy.exe
  2⤵
  PID:392
- C:\Windows\System\KmoKGqQ.exe
  C:\Windows\System\KmoKGqQ.exe
  2⤵
  PID:956
- C:\Windows\System\smcKJVs.exe
  C:\Windows\System\smcKJVs.exe
  2⤵
  PID:1768
- C:\Windows\System\rFRBhNq.exe
  C:\Windows\System\rFRBhNq.exe
  2⤵
  PID:1696
- C:\Windows\System\HwBHKuV.exe
  C:\Windows\System\HwBHKuV.exe
  2⤵
  PID:2516
- C:\Windows\System\sTLRwqD.exe
  C:\Windows\System\sTLRwqD.exe
  2⤵
  PID:1440
- C:\Windows\System\TQLTCnS.exe
  C:\Windows\System\TQLTCnS.exe
  2⤵
  PID:2264
- C:\Windows\System\UnCuUUk.exe
  C:\Windows\System\UnCuUUk.exe
  2⤵
  PID:756
- C:\Windows\System\NiAwrfE.exe
  C:\Windows\System\NiAwrfE.exe
  2⤵
  PID:1924
- C:\Windows\System\dssMIIp.exe
  C:\Windows\System\dssMIIp.exe
  2⤵
  PID:2136
- C:\Windows\System\UfoEVea.exe
  C:\Windows\System\UfoEVea.exe
  2⤵
  PID:1584
- C:\Windows\System\YltoiGX.exe
  C:\Windows\System\YltoiGX.exe
  2⤵
  PID:1668
- C:\Windows\System\OHJMOEV.exe
  C:\Windows\System\OHJMOEV.exe
  2⤵
  PID:2724
- C:\Windows\System\LxUhAwK.exe
  C:\Windows\System\LxUhAwK.exe
  2⤵
  PID:1532
- C:\Windows\System\VFoMIqR.exe
  C:\Windows\System\VFoMIqR.exe
  2⤵
  PID:2208
- C:\Windows\System\cLEQMEc.exe
  C:\Windows\System\cLEQMEc.exe
  2⤵
  PID:2444
- C:\Windows\System\qYrgoZI.exe
  C:\Windows\System\qYrgoZI.exe
  2⤵
  PID:2456
- C:\Windows\System\rxNwAQg.exe
  C:\Windows\System\rxNwAQg.exe
  2⤵
  PID:2224
- C:\Windows\System\BcWoMQd.exe
  C:\Windows\System\BcWoMQd.exe
  2⤵
  PID:2760
- C:\Windows\System\laXSliv.exe
  C:\Windows\System\laXSliv.exe
  2⤵
  PID:2952
- C:\Windows\System\EKVxjaB.exe
  C:\Windows\System\EKVxjaB.exe
  2⤵
  PID:892
- C:\Windows\System\UsGnzUb.exe
  C:\Windows\System\UsGnzUb.exe
  2⤵
  PID:1736
- C:\Windows\System\TIzCzPJ.exe
  C:\Windows\System\TIzCzPJ.exe
  2⤵
  PID:772
- C:\Windows\System\OeoOYAM.exe
  C:\Windows\System\OeoOYAM.exe
  2⤵
  PID:500
- C:\Windows\System\fFotLTF.exe
  C:\Windows\System\fFotLTF.exe
  2⤵
  PID:1072
- C:\Windows\System\JHsNzuO.exe
  C:\Windows\System\JHsNzuO.exe
  2⤵
  PID:2512
- C:\Windows\System\XgMbzWy.exe
  C:\Windows\System\XgMbzWy.exe
  2⤵
  PID:2096
- C:\Windows\System\nXPuByG.exe
  C:\Windows\System\nXPuByG.exe
  2⤵
  PID:2256
- C:\Windows\System\FUAgDkH.exe
  C:\Windows\System\FUAgDkH.exe
  2⤵
  PID:2728
- C:\Windows\System\ESDVbJQ.exe
  C:\Windows\System\ESDVbJQ.exe
  2⤵
  PID:2352
- C:\Windows\System\plfTPny.exe
  C:\Windows\System\plfTPny.exe
  2⤵
  PID:1716
- C:\Windows\System\GwUERcl.exe
  C:\Windows\System\GwUERcl.exe
  2⤵
  PID:1428
- C:\Windows\System\svAmaSE.exe
  C:\Windows\System\svAmaSE.exe
  2⤵
  PID:2536
- C:\Windows\System\YiIdPYm.exe
  C:\Windows\System\YiIdPYm.exe
  2⤵
  PID:1484
- C:\Windows\System\JcGrkUi.exe
  C:\Windows\System\JcGrkUi.exe
  2⤵
  PID:2304
- C:\Windows\System\midUZGy.exe
  C:\Windows\System\midUZGy.exe
  2⤵
  PID:948
- C:\Windows\System\McwfNIr.exe
  C:\Windows\System\McwfNIr.exe
  2⤵
  PID:3028
- C:\Windows\System\KIwWHBO.exe
  C:\Windows\System\KIwWHBO.exe
  2⤵
  PID:1700
- C:\Windows\System\mwkINMl.exe
  C:\Windows\System\mwkINMl.exe
  2⤵
  PID:2300
- C:\Windows\System\DMWlAuz.exe
  C:\Windows\System\DMWlAuz.exe
  2⤵
  PID:2720
- C:\Windows\System\jCpYmCM.exe
  C:\Windows\System\jCpYmCM.exe
  2⤵
  PID:2560
- C:\Windows\System\OJmwrPj.exe
  C:\Windows\System\OJmwrPj.exe
  2⤵
  PID:1684
- C:\Windows\System\pbvxreJ.exe
  C:\Windows\System\pbvxreJ.exe
  2⤵
  PID:376
- C:\Windows\System\dpyyGhI.exe
  C:\Windows\System\dpyyGhI.exe
  2⤵
  PID:808
- C:\Windows\System\uzbGEVg.exe
  C:\Windows\System\uzbGEVg.exe
  2⤵
  PID:984
- C:\Windows\System\roVjfoU.exe
  C:\Windows\System\roVjfoU.exe
  2⤵
  PID:356
- C:\Windows\System\nxyjMAL.exe
  C:\Windows\System\nxyjMAL.exe
  2⤵
  PID:1800
- C:\Windows\System\jqUSgvg.exe
  C:\Windows\System\jqUSgvg.exe
  2⤵
  PID:2648
- C:\Windows\System\cmUkiAk.exe
  C:\Windows\System\cmUkiAk.exe
  2⤵
  PID:1344
- C:\Windows\System\rbjeyDv.exe
  C:\Windows\System\rbjeyDv.exe
  2⤵
  PID:2176
- C:\Windows\System\yqcLaGU.exe
  C:\Windows\System\yqcLaGU.exe
  2⤵
  PID:2272
- C:\Windows\System\IPcBZgA.exe
  C:\Windows\System\IPcBZgA.exe
  2⤵
  PID:896
- C:\Windows\System\DyiKRmD.exe
  C:\Windows\System\DyiKRmD.exe
  2⤵
  PID:2840
- C:\Windows\System\NJlAaUy.exe
  C:\Windows\System\NJlAaUy.exe
  2⤵
  PID:2572
- C:\Windows\System\KvJFldb.exe
  C:\Windows\System\KvJFldb.exe
  2⤵
  PID:652
- C:\Windows\System\nVcwRbF.exe
  C:\Windows\System\nVcwRbF.exe
  2⤵
  PID:1244
- C:\Windows\System\TutKtGn.exe
  C:\Windows\System\TutKtGn.exe
  2⤵
  PID:1540
- C:\Windows\System\hZlraJE.exe
  C:\Windows\System\hZlraJE.exe
  2⤵
  PID:2204
- C:\Windows\System\EVuKFiP.exe
  C:\Windows\System\EVuKFiP.exe
  2⤵
  PID:3084
- C:\Windows\System\nJJmjaa.exe
  C:\Windows\System\nJJmjaa.exe
  2⤵
  PID:3100
- C:\Windows\System\ZAXYyts.exe
  C:\Windows\System\ZAXYyts.exe
  2⤵
  PID:3116
- C:\Windows\System\uyvgtCQ.exe
  C:\Windows\System\uyvgtCQ.exe
  2⤵
  PID:3132
- C:\Windows\System\HXXLwfl.exe
  C:\Windows\System\HXXLwfl.exe
  2⤵
  PID:3148
- C:\Windows\System\bYWsgGN.exe
  C:\Windows\System\bYWsgGN.exe
  2⤵
  PID:3164
- C:\Windows\System\lthxjzq.exe
  C:\Windows\System\lthxjzq.exe
  2⤵
  PID:3180
- C:\Windows\System\nuEXAVt.exe
  C:\Windows\System\nuEXAVt.exe
  2⤵
  PID:3196
- C:\Windows\System\lSquOsC.exe
  C:\Windows\System\lSquOsC.exe
  2⤵
  PID:3212
- C:\Windows\System\NHClrDJ.exe
  C:\Windows\System\NHClrDJ.exe
  2⤵
  PID:3228
- C:\Windows\System\tlHelAN.exe
  C:\Windows\System\tlHelAN.exe
  2⤵
  PID:3244
- C:\Windows\System\knNjnzu.exe
  C:\Windows\System\knNjnzu.exe
  2⤵
  PID:3260
- C:\Windows\System\zoNDejG.exe
  C:\Windows\System\zoNDejG.exe
  2⤵
  PID:3276
- C:\Windows\System\UrJgqoa.exe
  C:\Windows\System\UrJgqoa.exe
  2⤵
  PID:3292
- C:\Windows\System\FdqLTmd.exe
  C:\Windows\System\FdqLTmd.exe
  2⤵
  PID:3308
- C:\Windows\System\WValJfm.exe
  C:\Windows\System\WValJfm.exe
  2⤵
  PID:3324
- C:\Windows\System\kxeCQeZ.exe
  C:\Windows\System\kxeCQeZ.exe
  2⤵
  PID:3340
- C:\Windows\System\Ahwjjue.exe
  C:\Windows\System\Ahwjjue.exe
  2⤵
  PID:3356
- C:\Windows\System\PJuIQyU.exe
  C:\Windows\System\PJuIQyU.exe
  2⤵
  PID:3372
- C:\Windows\System\nzGDwqr.exe
  C:\Windows\System\nzGDwqr.exe
  2⤵
  PID:3388
- C:\Windows\System\yQbkdUK.exe
  C:\Windows\System\yQbkdUK.exe
  2⤵
  PID:3404
- C:\Windows\System\OWDntkA.exe
  C:\Windows\System\OWDntkA.exe
  2⤵
  PID:3420
- C:\Windows\System\YxzLjml.exe
  C:\Windows\System\YxzLjml.exe
  2⤵
  PID:3436
- C:\Windows\System\aIXusvn.exe
  C:\Windows\System\aIXusvn.exe
  2⤵
  PID:3452
- C:\Windows\System\IemtnMo.exe
  C:\Windows\System\IemtnMo.exe
  2⤵
  PID:3468
- C:\Windows\System\AHxoJaQ.exe
  C:\Windows\System\AHxoJaQ.exe
  2⤵
  PID:3484
- C:\Windows\System\UQDQMQu.exe
  C:\Windows\System\UQDQMQu.exe
  2⤵
  PID:3500
- C:\Windows\System\FLdTQzr.exe
  C:\Windows\System\FLdTQzr.exe
  2⤵
  PID:3516
- C:\Windows\System\MbBIkUw.exe
  C:\Windows\System\MbBIkUw.exe
  2⤵
  PID:3532
- C:\Windows\System\CnibbPx.exe
  C:\Windows\System\CnibbPx.exe
  2⤵
  PID:3548
- C:\Windows\System\alcHTac.exe
  C:\Windows\System\alcHTac.exe
  2⤵
  PID:3564
- C:\Windows\System\YEEDwCG.exe
  C:\Windows\System\YEEDwCG.exe
  2⤵
  PID:3580
- C:\Windows\System\YGKkgZH.exe
  C:\Windows\System\YGKkgZH.exe
  2⤵
  PID:3596
- C:\Windows\System\juxWWPm.exe
  C:\Windows\System\juxWWPm.exe
  2⤵
  PID:3612
- C:\Windows\System\YArxPXY.exe
  C:\Windows\System\YArxPXY.exe
  2⤵
  PID:3628
- C:\Windows\System\PNemCjv.exe
  C:\Windows\System\PNemCjv.exe
  2⤵
  PID:3644
- C:\Windows\System\RVpfQFL.exe
  C:\Windows\System\RVpfQFL.exe
  2⤵
  PID:3660
- C:\Windows\System\OalgBus.exe
  C:\Windows\System\OalgBus.exe
  2⤵
  PID:3676
- C:\Windows\System\iZyhpOY.exe
  C:\Windows\System\iZyhpOY.exe
  2⤵
  PID:3692
- C:\Windows\System\XEBhreB.exe
  C:\Windows\System\XEBhreB.exe
  2⤵
  PID:3708
- C:\Windows\System\IbZnrSg.exe
  C:\Windows\System\IbZnrSg.exe
  2⤵
  PID:3724
- C:\Windows\System\RFBGsjW.exe
  C:\Windows\System\RFBGsjW.exe
  2⤵
  PID:3740
- C:\Windows\System\PtMweLf.exe
  C:\Windows\System\PtMweLf.exe
  2⤵
  PID:3756
- C:\Windows\System\GFxeERB.exe
  C:\Windows\System\GFxeERB.exe
  2⤵
  PID:3772
- C:\Windows\System\xfINRgf.exe
  C:\Windows\System\xfINRgf.exe
  2⤵
  PID:3788
- C:\Windows\System\ZgBnGuS.exe
  C:\Windows\System\ZgBnGuS.exe
  2⤵
  PID:3804
- C:\Windows\System\ucMsqdT.exe
  C:\Windows\System\ucMsqdT.exe
  2⤵
  PID:3820
- C:\Windows\System\PHDuKQT.exe
  C:\Windows\System\PHDuKQT.exe
  2⤵
  PID:3836
- C:\Windows\System\JFHDPDM.exe
  C:\Windows\System\JFHDPDM.exe
  2⤵
  PID:3852
- C:\Windows\System\woOGJZa.exe
  C:\Windows\System\woOGJZa.exe
  2⤵
  PID:3868
- C:\Windows\System\xTRhBnA.exe
  C:\Windows\System\xTRhBnA.exe
  2⤵
  PID:3884
- C:\Windows\System\uygNHXz.exe
  C:\Windows\System\uygNHXz.exe
  2⤵
  PID:3900
- C:\Windows\System\wdUqHYu.exe
  C:\Windows\System\wdUqHYu.exe
  2⤵
  PID:3916
- C:\Windows\System\ERliyZX.exe
  C:\Windows\System\ERliyZX.exe
  2⤵
  PID:3932
- C:\Windows\System\rFDtSvN.exe
  C:\Windows\System\rFDtSvN.exe
  2⤵
  PID:3948
- C:\Windows\System\ksRnhWT.exe
  C:\Windows\System\ksRnhWT.exe
  2⤵
  PID:3968
- C:\Windows\System\HfkjAeh.exe
  C:\Windows\System\HfkjAeh.exe
  2⤵
  PID:3984
- C:\Windows\System\RmZtCGp.exe
  C:\Windows\System\RmZtCGp.exe
  2⤵
  PID:4000
- C:\Windows\System\XMuSKqQ.exe
  C:\Windows\System\XMuSKqQ.exe
  2⤵
  PID:4016
- C:\Windows\System\nyDKhyC.exe
  C:\Windows\System\nyDKhyC.exe
  2⤵
  PID:4032
- C:\Windows\System\FpcTqqR.exe
  C:\Windows\System\FpcTqqR.exe
  2⤵
  PID:4048
- C:\Windows\System\EgCcfJU.exe
  C:\Windows\System\EgCcfJU.exe
  2⤵
  PID:4064
- C:\Windows\System\kNVgMVI.exe
  C:\Windows\System\kNVgMVI.exe
  2⤵
  PID:4080
- C:\Windows\System\oufbPPn.exe
  C:\Windows\System\oufbPPn.exe
  2⤵
  PID:564
- C:\Windows\System\MMHIuTG.exe
  C:\Windows\System\MMHIuTG.exe
  2⤵
  PID:1640
- C:\Windows\System\azIeQbA.exe
  C:\Windows\System\azIeQbA.exe
  2⤵
  PID:2140
- C:\Windows\System\GDyHtke.exe
  C:\Windows\System\GDyHtke.exe
  2⤵
  PID:3300
- C:\Windows\System\stEpYlm.exe
  C:\Windows\System\stEpYlm.exe
  2⤵
  PID:3320
- C:\Windows\System\IFsaODT.exe
  C:\Windows\System\IFsaODT.exe
  2⤵
  PID:3336
- C:\Windows\System\TmWZxmH.exe
  C:\Windows\System\TmWZxmH.exe
  2⤵
  PID:3384
- C:\Windows\System\btHOHXW.exe
  C:\Windows\System\btHOHXW.exe
  2⤵
  PID:3412
- C:\Windows\System\MEivPXh.exe
  C:\Windows\System\MEivPXh.exe
  2⤵
  PID:3428
- C:\Windows\System\GTFtcWC.exe
  C:\Windows\System\GTFtcWC.exe
  2⤵
  PID:3448
- C:\Windows\System\IPutkmS.exe
  C:\Windows\System\IPutkmS.exe
  2⤵
  PID:3464
- C:\Windows\System\QKBQLNx.exe
  C:\Windows\System\QKBQLNx.exe
  2⤵
  PID:2432
- C:\Windows\System\tKhZbdR.exe
  C:\Windows\System\tKhZbdR.exe
  2⤵
  PID:3496
- C:\Windows\System\NvLEaES.exe
  C:\Windows\System\NvLEaES.exe
  2⤵
  PID:3540
- C:\Windows\System\btJxjvW.exe
  C:\Windows\System\btJxjvW.exe
  2⤵
  PID:3544
- C:\Windows\System\MraKDzG.exe
  C:\Windows\System\MraKDzG.exe
  2⤵
  PID:3572
- C:\Windows\System\GbAgMFe.exe
  C:\Windows\System\GbAgMFe.exe
  2⤵
  PID:2664
- C:\Windows\System\HjBZslE.exe
  C:\Windows\System\HjBZslE.exe
  2⤵
  PID:3592
- C:\Windows\System\JPNSGqX.exe
  C:\Windows\System\JPNSGqX.exe
  2⤵
  PID:2404
- C:\Windows\System\bPAaLkt.exe
  C:\Windows\System\bPAaLkt.exe
  2⤵
  PID:3624
- C:\Windows\System\xZHgEiE.exe
  C:\Windows\System\xZHgEiE.exe
  2⤵
  PID:1956
- C:\Windows\System\EagNqCh.exe
  C:\Windows\System\EagNqCh.exe
  2⤵
  PID:3672
- C:\Windows\System\TdPcrYi.exe
  C:\Windows\System\TdPcrYi.exe
  2⤵
  PID:3704
- C:\Windows\System\RahihfG.exe
  C:\Windows\System\RahihfG.exe
  2⤵
  PID:1628
- C:\Windows\System\FoZOhCx.exe
  C:\Windows\System\FoZOhCx.exe
  2⤵
  PID:3752
- C:\Windows\System\bVepPrG.exe
  C:\Windows\System\bVepPrG.exe
  2⤵
  PID:2916
- C:\Windows\System\tQRGwUS.exe
  C:\Windows\System\tQRGwUS.exe
  2⤵
  PID:3828
- C:\Windows\System\rGednwe.exe
  C:\Windows\System\rGednwe.exe
  2⤵
  PID:3860
- C:\Windows\System\YemnNMX.exe
  C:\Windows\System\YemnNMX.exe
  2⤵
  PID:3892
- C:\Windows\System\OBWypKF.exe
  C:\Windows\System\OBWypKF.exe
  2⤵
  PID:3908
- C:\Windows\System\VZRqTVR.exe
  C:\Windows\System\VZRqTVR.exe
  2⤵
  PID:3940
- C:\Windows\System\eHmWWxg.exe
  C:\Windows\System\eHmWWxg.exe
  2⤵
  PID:3976
- C:\Windows\System\AdVUXyg.exe
  C:\Windows\System\AdVUXyg.exe
  2⤵
  PID:1204
- C:\Windows\System\UCaeKgx.exe
  C:\Windows\System\UCaeKgx.exe
  2⤵
  PID:2640
- C:\Windows\System\NraKusm.exe
  C:\Windows\System\NraKusm.exe
  2⤵
  PID:4056
- C:\Windows\System\WxSAtSX.exe
  C:\Windows\System\WxSAtSX.exe
  2⤵
  PID:4088
- C:\Windows\System\PPsvNvz.exe
  C:\Windows\System\PPsvNvz.exe
  2⤵
  PID:2596
- C:\Windows\System\qVkAUEI.exe
  C:\Windows\System\qVkAUEI.exe
  2⤵
  PID:784
- C:\Windows\System\HkHvLLV.exe
  C:\Windows\System\HkHvLLV.exe
  2⤵
  PID:2844
- C:\Windows\System\JrngHkQ.exe
  C:\Windows\System\JrngHkQ.exe
  2⤵
  PID:2132
- C:\Windows\System\SovctbO.exe
  C:\Windows\System\SovctbO.exe
  2⤵
  PID:3204
- C:\Windows\System\jGUlYQG.exe
  C:\Windows\System\jGUlYQG.exe
  2⤵
  PID:3144
- C:\Windows\System\enhsncb.exe
  C:\Windows\System\enhsncb.exe
  2⤵
  PID:3188
- C:\Windows\System\BzlLgSC.exe
  C:\Windows\System\BzlLgSC.exe
  2⤵
  PID:3224
- C:\Windows\System\BqxaVSV.exe
  C:\Windows\System\BqxaVSV.exe
  2⤵
  PID:1672
- C:\Windows\System\OWmCNme.exe
  C:\Windows\System\OWmCNme.exe
  2⤵
  PID:3208
- C:\Windows\System\WwlaNAw.exe
  C:\Windows\System\WwlaNAw.exe
  2⤵
  PID:3316
- C:\Windows\System\jyGviqz.exe
  C:\Windows\System\jyGviqz.exe
  2⤵
  PID:3352
- C:\Windows\System\beUHeXW.exe
  C:\Windows\System\beUHeXW.exe
  2⤵
  PID:3444
- C:\Windows\System\owdHQId.exe
  C:\Windows\System\owdHQId.exe
  2⤵
  PID:2412
- C:\Windows\System\wuxZleE.exe
  C:\Windows\System\wuxZleE.exe
  2⤵
  PID:2076
- C:\Windows\System\LNYvTcP.exe
  C:\Windows\System\LNYvTcP.exe
  2⤵
  PID:3640
- C:\Windows\System\iXKazoT.exe
  C:\Windows\System\iXKazoT.exe
  2⤵
  PID:2768
- C:\Windows\System\wVwxlOY.exe
  C:\Windows\System\wVwxlOY.exe
  2⤵
  PID:2956
- C:\Windows\System\yZXEdaZ.exe
  C:\Windows\System\yZXEdaZ.exe
  2⤵
  PID:3480
- C:\Windows\System\MzYNTHi.exe
  C:\Windows\System\MzYNTHi.exe
  2⤵
  PID:3764
- C:\Windows\System\RqcKNUS.exe
  C:\Windows\System\RqcKNUS.exe
  2⤵
  PID:3732
- C:\Windows\System\oRxubsI.exe
  C:\Windows\System\oRxubsI.exe
  2⤵
  PID:3796
- C:\Windows\System\uoVRnKr.exe
  C:\Windows\System\uoVRnKr.exe
  2⤵
  PID:3912
- C:\Windows\System\qTSRKQD.exe
  C:\Windows\System\qTSRKQD.exe
  2⤵
  PID:3880
- C:\Windows\System\jbXIglL.exe
  C:\Windows\System\jbXIglL.exe
  2⤵
  PID:4028
- C:\Windows\System\GrGVXxk.exe
  C:\Windows\System\GrGVXxk.exe
  2⤵
  PID:2368
- C:\Windows\System\ZRpuDnZ.exe
  C:\Windows\System\ZRpuDnZ.exe
  2⤵
  PID:3076
- C:\Windows\System\YIFvneW.exe
  C:\Windows\System\YIFvneW.exe
  2⤵
  PID:3172
- C:\Windows\System\rlyZnkc.exe
  C:\Windows\System\rlyZnkc.exe
  2⤵
  PID:4040
- C:\Windows\System\AAwUNjE.exe
  C:\Windows\System\AAwUNjE.exe
  2⤵
  PID:3176
- C:\Windows\System\Lojikuz.exe
  C:\Windows\System\Lojikuz.exe
  2⤵
  PID:3096
- C:\Windows\System\uCxZmOu.exe
  C:\Windows\System\uCxZmOu.exe
  2⤵
  PID:3128
- C:\Windows\System\rLkNCxA.exe
  C:\Windows\System\rLkNCxA.exe
  2⤵
  PID:3588
- C:\Windows\System\HOvRFpg.exe
  C:\Windows\System\HOvRFpg.exe
  2⤵
  PID:576
- C:\Windows\System\MRuVgVs.exe
  C:\Windows\System\MRuVgVs.exe
  2⤵
  PID:3960
- C:\Windows\System\QBTbDXD.exe
  C:\Windows\System\QBTbDXD.exe
  2⤵
  PID:2684
- C:\Windows\System\MeQMoUk.exe
  C:\Windows\System\MeQMoUk.exe
  2⤵
  PID:1732
- C:\Windows\System\nBlCzHI.exe
  C:\Windows\System\nBlCzHI.exe
  2⤵
  PID:3832
- C:\Windows\System\JbhRGiH.exe
  C:\Windows\System\JbhRGiH.exe
  2⤵
  PID:3620
- C:\Windows\System\ahAshpT.exe
  C:\Windows\System\ahAshpT.exe
  2⤵
  PID:3768
- C:\Windows\System\UAxcVwN.exe
  C:\Windows\System\UAxcVwN.exe
  2⤵
  PID:3876
- C:\Windows\System\IRmZiiK.exe
  C:\Windows\System\IRmZiiK.exe
  2⤵
  PID:3560
- C:\Windows\System\SAlzINd.exe
  C:\Windows\System\SAlzINd.exe
  2⤵
  PID:1572
- C:\Windows\System\PVtGnYZ.exe
  C:\Windows\System\PVtGnYZ.exe
  2⤵
  PID:3112
- C:\Windows\System\qTgKVac.exe
  C:\Windows\System\qTgKVac.exe
  2⤵
  PID:540
- C:\Windows\System\ybxmSXM.exe
  C:\Windows\System\ybxmSXM.exe
  2⤵
  PID:4072
- C:\Windows\System\otViCQH.exe
  C:\Windows\System\otViCQH.exe
  2⤵
  PID:3348
- C:\Windows\System\QffLxtV.exe
  C:\Windows\System\QffLxtV.exe
  2⤵
  PID:3688
- C:\Windows\System\JyGfknD.exe
  C:\Windows\System\JyGfknD.exe
  2⤵
  PID:3844
- C:\Windows\System\ASMlSmk.exe
  C:\Windows\System\ASMlSmk.exe
  2⤵
  PID:4104
- C:\Windows\System\Mhnbffn.exe
  C:\Windows\System\Mhnbffn.exe
  2⤵
  PID:4120
- C:\Windows\System\ixhQrGJ.exe
  C:\Windows\System\ixhQrGJ.exe
  2⤵
  PID:4136
- C:\Windows\System\XAhApPe.exe
  C:\Windows\System\XAhApPe.exe
  2⤵
  PID:4156
- C:\Windows\System\uCTqRhm.exe
  C:\Windows\System\uCTqRhm.exe
  2⤵
  PID:4172
- C:\Windows\System\cPhhPmg.exe
  C:\Windows\System\cPhhPmg.exe
  2⤵
  PID:4192
- C:\Windows\System\GaZELcp.exe
  C:\Windows\System\GaZELcp.exe
  2⤵
  PID:4208
- C:\Windows\System\BYGbaVI.exe
  C:\Windows\System\BYGbaVI.exe
  2⤵
  PID:4228
- C:\Windows\System\yqSkNBy.exe
  C:\Windows\System\yqSkNBy.exe
  2⤵
  PID:4244
- C:\Windows\System\QksnVyM.exe
  C:\Windows\System\QksnVyM.exe
  2⤵
  PID:4260
- C:\Windows\System\AdaUMSE.exe
  C:\Windows\System\AdaUMSE.exe
  2⤵
  PID:4276
- C:\Windows\System\HsnXTZx.exe
  C:\Windows\System\HsnXTZx.exe
  2⤵
  PID:4292
- C:\Windows\System\EbeHhqf.exe
  C:\Windows\System\EbeHhqf.exe
  2⤵
  PID:4308
- C:\Windows\System\hQiKSHX.exe
  C:\Windows\System\hQiKSHX.exe
  2⤵
  PID:4324
- C:\Windows\System\gjmNFUp.exe
  C:\Windows\System\gjmNFUp.exe
  2⤵
  PID:4340
- C:\Windows\System\BBdwXTA.exe
  C:\Windows\System\BBdwXTA.exe
  2⤵
  PID:4356
- C:\Windows\System\yITxcYv.exe
  C:\Windows\System\yITxcYv.exe
  2⤵
  PID:4372
- C:\Windows\System\eghjXMY.exe
  C:\Windows\System\eghjXMY.exe
  2⤵
  PID:4392
- C:\Windows\System\ycaLEQO.exe
  C:\Windows\System\ycaLEQO.exe
  2⤵
  PID:4408
- C:\Windows\System\ABtApcy.exe
  C:\Windows\System\ABtApcy.exe
  2⤵
  PID:4428
- C:\Windows\System\iPwBCty.exe
  C:\Windows\System\iPwBCty.exe
  2⤵
  PID:4444
- C:\Windows\System\UkyySvA.exe
  C:\Windows\System\UkyySvA.exe
  2⤵
  PID:4460
- C:\Windows\System\jyugXQr.exe
  C:\Windows\System\jyugXQr.exe
  2⤵
  PID:4476
- C:\Windows\System\clMaqjd.exe
  C:\Windows\System\clMaqjd.exe
  2⤵
  PID:4496
- C:\Windows\System\AUXbIsJ.exe
  C:\Windows\System\AUXbIsJ.exe
  2⤵
  PID:4512
- C:\Windows\System\GqKIpGI.exe
  C:\Windows\System\GqKIpGI.exe
  2⤵
  PID:4528
- C:\Windows\System\dfWTSgD.exe
  C:\Windows\System\dfWTSgD.exe
  2⤵
  PID:4544
- C:\Windows\System\fWxyfyk.exe
  C:\Windows\System\fWxyfyk.exe
  2⤵
  PID:4564
- C:\Windows\System\HgryfjV.exe
  C:\Windows\System\HgryfjV.exe
  2⤵
  PID:4580
- C:\Windows\System\uUOUYYU.exe
  C:\Windows\System\uUOUYYU.exe
  2⤵
  PID:4596
- C:\Windows\System\xzXyLpc.exe
  C:\Windows\System\xzXyLpc.exe
  2⤵
  PID:4612
- C:\Windows\System\ZAelSBP.exe
  C:\Windows\System\ZAelSBP.exe
  2⤵
  PID:4632
- C:\Windows\System\wnznTUk.exe
  C:\Windows\System\wnznTUk.exe
  2⤵
  PID:4648
- C:\Windows\System\qaNMyaV.exe
  C:\Windows\System\qaNMyaV.exe
  2⤵
  PID:4664
- C:\Windows\System\TUgSSYp.exe
  C:\Windows\System\TUgSSYp.exe
  2⤵
  PID:4680
- C:\Windows\System\xCPvblw.exe
  C:\Windows\System\xCPvblw.exe
  2⤵
  PID:4696
- C:\Windows\System\lUOKQWN.exe
  C:\Windows\System\lUOKQWN.exe
  2⤵
  PID:4716
- C:\Windows\System\CBoBgDF.exe
  C:\Windows\System\CBoBgDF.exe
  2⤵
  PID:4732
- C:\Windows\System\kHIVbeh.exe
  C:\Windows\System\kHIVbeh.exe
  2⤵
  PID:4748
- C:\Windows\System\EqmCuBc.exe
  C:\Windows\System\EqmCuBc.exe
  2⤵
  PID:4764
- C:\Windows\System\FnrnvdX.exe
  C:\Windows\System\FnrnvdX.exe
  2⤵
  PID:4784
- C:\Windows\System\dnZmMDx.exe
  C:\Windows\System\dnZmMDx.exe
  2⤵
  PID:4800
- C:\Windows\System\JpPStfZ.exe
  C:\Windows\System\JpPStfZ.exe
  2⤵
  PID:4820
- C:\Windows\System\igmFUNx.exe
  C:\Windows\System\igmFUNx.exe
  2⤵
  PID:4840
- C:\Windows\System\IKeyaPN.exe
  C:\Windows\System\IKeyaPN.exe
  2⤵
  PID:4856
- C:\Windows\System\OFIzkhe.exe
  C:\Windows\System\OFIzkhe.exe
  2⤵
  PID:4872
- C:\Windows\System\SLJZYPZ.exe
  C:\Windows\System\SLJZYPZ.exe
  2⤵
  PID:4888
- C:\Windows\System\IwmTEer.exe
  C:\Windows\System\IwmTEer.exe
  2⤵
  PID:4904
- C:\Windows\System\fmhPfvD.exe
  C:\Windows\System\fmhPfvD.exe
  2⤵
  PID:4920
- C:\Windows\System\PlOWkgD.exe
  C:\Windows\System\PlOWkgD.exe
  2⤵
  PID:4936
- C:\Windows\System\SfpgTpM.exe
  C:\Windows\System\SfpgTpM.exe
  2⤵
  PID:4952
- C:\Windows\System\smSgjwZ.exe
  C:\Windows\System\smSgjwZ.exe
  2⤵
  PID:4968
- C:\Windows\System\vEaVVMq.exe
  C:\Windows\System\vEaVVMq.exe
  2⤵
  PID:4984
- C:\Windows\System\cCKumvA.exe
  C:\Windows\System\cCKumvA.exe
  2⤵
  PID:5000
- C:\Windows\System\bIfWaBr.exe
  C:\Windows\System\bIfWaBr.exe
  2⤵
  PID:5016
- C:\Windows\System\FpyKEgd.exe
  C:\Windows\System\FpyKEgd.exe
  2⤵
  PID:5032
- C:\Windows\System\VOJCJBg.exe
  C:\Windows\System\VOJCJBg.exe
  2⤵
  PID:5048
- C:\Windows\System\YRywADn.exe
  C:\Windows\System\YRywADn.exe
  2⤵
  PID:5064
- C:\Windows\System\VJHGyDL.exe
  C:\Windows\System\VJHGyDL.exe
  2⤵
  PID:5080
- C:\Windows\System\OfkuMeN.exe
  C:\Windows\System\OfkuMeN.exe
  2⤵
  PID:5100
- C:\Windows\System\RQJmSgQ.exe
  C:\Windows\System\RQJmSgQ.exe
  2⤵
  PID:5116
- C:\Windows\System\paMhUWZ.exe
  C:\Windows\System\paMhUWZ.exe
  2⤵
  PID:4112
- C:\Windows\System\ToGJzJo.exe
  C:\Windows\System\ToGJzJo.exe
  2⤵
  PID:4152
- C:\Windows\System\qFkprml.exe
  C:\Windows\System\qFkprml.exe
  2⤵
  PID:4184
- C:\Windows\System\FaHSarc.exe
  C:\Windows\System\FaHSarc.exe
  2⤵
  PID:4100
- C:\Windows\System\VfrUpZv.exe
  C:\Windows\System\VfrUpZv.exe
  2⤵
  PID:4252
- C:\Windows\System\WfkDgyX.exe
  C:\Windows\System\WfkDgyX.exe
  2⤵
  PID:4316
- C:\Windows\System\luYYNoB.exe
  C:\Windows\System\luYYNoB.exe
  2⤵
  PID:4352
- C:\Windows\System\EMBudKx.exe
  C:\Windows\System\EMBudKx.exe
  2⤵
  PID:4420
- C:\Windows\System\gmmPWmj.exe
  C:\Windows\System\gmmPWmj.exe
  2⤵
  PID:4484
- C:\Windows\System\wXkGFEe.exe
  C:\Windows\System\wXkGFEe.exe
  2⤵
  PID:4268
- C:\Windows\System\jZosugS.exe
  C:\Windows\System\jZosugS.exe
  2⤵
  PID:4492
- C:\Windows\System\LCAqtpX.exe
  C:\Windows\System\LCAqtpX.exe
  2⤵
  PID:4556
- C:\Windows\System\OFkyFiR.exe
  C:\Windows\System\OFkyFiR.exe
  2⤵
  PID:4592
- C:\Windows\System\AjKPuIl.exe
  C:\Windows\System\AjKPuIl.exe
  2⤵
  PID:4656
- C:\Windows\System\pMtNxPg.exe
  C:\Windows\System\pMtNxPg.exe
  2⤵
  PID:4728
- C:\Windows\System\fheCaOL.exe
  C:\Windows\System\fheCaOL.exe
  2⤵
  PID:4368
- C:\Windows\System\uPMvWvt.exe
  C:\Windows\System\uPMvWvt.exe
  2⤵
  PID:4468
- C:\Windows\System\imvIKgB.exe
  C:\Windows\System\imvIKgB.exe
  2⤵
  PID:4304
- C:\Windows\System\ROlldcJ.exe
  C:\Windows\System\ROlldcJ.exe
  2⤵
  PID:4572
- C:\Windows\System\PtstMhV.exe
  C:\Windows\System\PtstMhV.exe
  2⤵
  PID:4676
- C:\Windows\System\uNUmkUb.exe
  C:\Windows\System\uNUmkUb.exe
  2⤵
  PID:4864
- C:\Windows\System\VFcmOwL.exe
  C:\Windows\System\VFcmOwL.exe
  2⤵
  PID:4900
- C:\Windows\System\BkcnGDt.exe
  C:\Windows\System\BkcnGDt.exe
  2⤵
  PID:4964
- C:\Windows\System\MRtnzBk.exe
  C:\Windows\System\MRtnzBk.exe
  2⤵
  PID:4364
- C:\Windows\System\DkPglLW.exe
  C:\Windows\System\DkPglLW.exe
  2⤵
  PID:4404
- C:\Windows\System\YLYPZxn.exe
  C:\Windows\System\YLYPZxn.exe
  2⤵
  PID:4508
- C:\Windows\System\eghzGGm.exe
  C:\Windows\System\eghzGGm.exe
  2⤵
  PID:4704
- C:\Windows\System\EFLEfQs.exe
  C:\Windows\System\EFLEfQs.exe
  2⤵
  PID:5056
- C:\Windows\System\zxHjXrD.exe
  C:\Windows\System\zxHjXrD.exe
  2⤵
  PID:5096
- C:\Windows\System\CzxzdzV.exe
  C:\Windows\System\CzxzdzV.exe
  2⤵
  PID:4180
- C:\Windows\System\XzHaKfs.exe
  C:\Windows\System\XzHaKfs.exe
  2⤵
  PID:4452
- C:\Windows\System\BRZnEis.exe
  C:\Windows\System\BRZnEis.exe
  2⤵
  PID:4224
- C:\Windows\System\aAawnvH.exe
  C:\Windows\System\aAawnvH.exe
  2⤵
  PID:4332
- C:\Windows\System\PDaoFsM.exe
  C:\Windows\System\PDaoFsM.exe
  2⤵
  PID:4724
- C:\Windows\System\hbWLJIB.exe
  C:\Windows\System\hbWLJIB.exe
  2⤵
  PID:4832
- C:\Windows\System\DFBCZYY.exe
  C:\Windows\System\DFBCZYY.exe
  2⤵
  PID:4776
- C:\Windows\System\jsNuBqE.exe
  C:\Windows\System\jsNuBqE.exe
  2⤵
  PID:5040
- C:\Windows\System\TYazWzQ.exe
  C:\Windows\System\TYazWzQ.exe
  2⤵
  PID:5112
- C:\Windows\System\kSnKLBI.exe
  C:\Windows\System\kSnKLBI.exe
  2⤵
  PID:4284
- C:\Windows\System\REkpLXp.exe
  C:\Windows\System\REkpLXp.exe
  2⤵
  PID:4880
- C:\Windows\System\jxJaZFE.exe
  C:\Windows\System\jxJaZFE.exe
  2⤵
  PID:4628
- C:\Windows\System\PdColyt.exe
  C:\Windows\System\PdColyt.exe
  2⤵
  PID:4240
- C:\Windows\System\bZktdCC.exe
  C:\Windows\System\bZktdCC.exe
  2⤵
  PID:4400
- C:\Windows\System\NHLxTmD.exe
  C:\Windows\System\NHLxTmD.exe
  2⤵
  PID:4896
- C:\Windows\System\iKKkmLA.exe
  C:\Windows\System\iKKkmLA.exe
  2⤵
  PID:4980
- C:\Windows\System\viTRXFU.exe
  C:\Windows\System\viTRXFU.exe
  2⤵
  PID:4148
- C:\Windows\System\YAaTTkI.exe
  C:\Windows\System\YAaTTkI.exe
  2⤵
  PID:4336
- C:\Windows\System\ngFuMxk.exe
  C:\Windows\System\ngFuMxk.exe
  2⤵
  PID:4852
- C:\Windows\System\mkrXUqO.exe
  C:\Windows\System\mkrXUqO.exe
  2⤵
  PID:4272
- C:\Windows\System\ZVKwAvz.exe
  C:\Windows\System\ZVKwAvz.exe
  2⤵
  PID:3252
- C:\Windows\System\OxioCEG.exe
  C:\Windows\System\OxioCEG.exe
  2⤵
  PID:4540
- C:\Windows\System\NlRusvG.exe
  C:\Windows\System\NlRusvG.exe
  2⤵
  PID:4536
- C:\Windows\System\HnsOypI.exe
  C:\Windows\System\HnsOypI.exe
  2⤵
  PID:4220
- C:\Windows\System\RVKdiMX.exe
  C:\Windows\System\RVKdiMX.exe
  2⤵
  PID:4960
- C:\Windows\System\cvKyXHx.exe
  C:\Windows\System\cvKyXHx.exe
  2⤵
  PID:4672
- C:\Windows\System\HVnGgnq.exe
  C:\Windows\System\HVnGgnq.exe
  2⤵
  PID:4760
- C:\Windows\System\hYFKjuO.exe
  C:\Windows\System\hYFKjuO.exe
  2⤵
  PID:4236
- C:\Windows\System\NtvyEnK.exe
  C:\Windows\System\NtvyEnK.exe
  2⤵
  PID:4132
- C:\Windows\System\jizkGyz.exe
  C:\Windows\System\jizkGyz.exe
  2⤵
  PID:4216
- C:\Windows\System\MXuwopO.exe
  C:\Windows\System\MXuwopO.exe
  2⤵
  PID:4948
- C:\Windows\System\KyMntXr.exe
  C:\Windows\System\KyMntXr.exe
  2⤵
  PID:5136
- C:\Windows\System\kwHOZWH.exe
  C:\Windows\System\kwHOZWH.exe
  2⤵
  PID:5152
- C:\Windows\System\BBYIQyh.exe
  C:\Windows\System\BBYIQyh.exe
  2⤵
  PID:5168
- C:\Windows\System\XhOkIgG.exe
  C:\Windows\System\XhOkIgG.exe
  2⤵
  PID:5184
- C:\Windows\System\YKVlzOL.exe
  C:\Windows\System\YKVlzOL.exe
  2⤵
  PID:5200
- C:\Windows\System\jnGKEcN.exe
  C:\Windows\System\jnGKEcN.exe
  2⤵
  PID:5216
- C:\Windows\System\NEMDdhR.exe
  C:\Windows\System\NEMDdhR.exe
  2⤵
  PID:5232
- C:\Windows\System\IdQnFlc.exe
  C:\Windows\System\IdQnFlc.exe
  2⤵
  PID:5248
- C:\Windows\System\ByZjhuN.exe
  C:\Windows\System\ByZjhuN.exe
  2⤵
  PID:5264
- C:\Windows\System\jJOXqjK.exe
  C:\Windows\System\jJOXqjK.exe
  2⤵
  PID:5280
- C:\Windows\System\mVxKIsS.exe
  C:\Windows\System\mVxKIsS.exe
  2⤵
  PID:5296
- C:\Windows\System\WWXvWHn.exe
  C:\Windows\System\WWXvWHn.exe
  2⤵
  PID:5400
- C:\Windows\System\qvntcaC.exe
  C:\Windows\System\qvntcaC.exe
  2⤵
  PID:5416
- C:\Windows\System\fZdeASW.exe
  C:\Windows\System\fZdeASW.exe
  2⤵
  PID:5432
- C:\Windows\System\qFJEyvY.exe
  C:\Windows\System\qFJEyvY.exe
  2⤵
  PID:5448
- C:\Windows\System\LZUYhDB.exe
  C:\Windows\System\LZUYhDB.exe
  2⤵
  PID:5464
- C:\Windows\System\AmdEvhV.exe
  C:\Windows\System\AmdEvhV.exe
  2⤵
  PID:5480
- C:\Windows\System\SPTqILv.exe
  C:\Windows\System\SPTqILv.exe
  2⤵
  PID:5496
- C:\Windows\System\vVTocAi.exe
  C:\Windows\System\vVTocAi.exe
  2⤵
  PID:5512
- C:\Windows\System\jATIFip.exe
  C:\Windows\System\jATIFip.exe
  2⤵
  PID:5528
- C:\Windows\System\xyNcqgf.exe
  C:\Windows\System\xyNcqgf.exe
  2⤵
  PID:5544
- C:\Windows\System\nvgldoQ.exe
  C:\Windows\System\nvgldoQ.exe
  2⤵
  PID:5560
- C:\Windows\System\GJjuvvi.exe
  C:\Windows\System\GJjuvvi.exe
  2⤵
  PID:5576
- C:\Windows\System\hiQzXYZ.exe
  C:\Windows\System\hiQzXYZ.exe
  2⤵
  PID:5592
- C:\Windows\System\trIjzvU.exe
  C:\Windows\System\trIjzvU.exe
  2⤵
  PID:5608
- C:\Windows\System\qoEVrxO.exe
  C:\Windows\System\qoEVrxO.exe
  2⤵
  PID:5624
- C:\Windows\System\PjrYpqm.exe
  C:\Windows\System\PjrYpqm.exe
  2⤵
  PID:5640
- C:\Windows\System\uwXHUYC.exe
  C:\Windows\System\uwXHUYC.exe
  2⤵
  PID:5656
- C:\Windows\System\ZcWvXQh.exe
  C:\Windows\System\ZcWvXQh.exe
  2⤵
  PID:5672
- C:\Windows\System\NImMjdV.exe
  C:\Windows\System\NImMjdV.exe
  2⤵
  PID:5712
- C:\Windows\System\heQjmKD.exe
  C:\Windows\System\heQjmKD.exe
  2⤵
  PID:5732
- C:\Windows\System\ptlRWQB.exe
  C:\Windows\System\ptlRWQB.exe
  2⤵
  PID:5748
- C:\Windows\System\rptFbzk.exe
  C:\Windows\System\rptFbzk.exe
  2⤵
  PID:5768
- C:\Windows\System\bGGzzgm.exe
  C:\Windows\System\bGGzzgm.exe
  2⤵
  PID:5784
- C:\Windows\System\apCVTcv.exe
  C:\Windows\System\apCVTcv.exe
  2⤵
  PID:5804
- C:\Windows\System\zgVlerh.exe
  C:\Windows\System\zgVlerh.exe
  2⤵
  PID:5820
- C:\Windows\System\jstUdHY.exe
  C:\Windows\System\jstUdHY.exe
  2⤵
  PID:5836
- C:\Windows\System\McznIfb.exe
  C:\Windows\System\McznIfb.exe
  2⤵
  PID:5856
- C:\Windows\System\OWzBcUy.exe
  C:\Windows\System\OWzBcUy.exe
  2⤵
  PID:5872
- C:\Windows\System\KRGVyEs.exe
  C:\Windows\System\KRGVyEs.exe
  2⤵
  PID:5892
- C:\Windows\System\jnkjJJq.exe
  C:\Windows\System\jnkjJJq.exe
  2⤵
  PID:5908
- C:\Windows\System\ZnnhJrr.exe
  C:\Windows\System\ZnnhJrr.exe
  2⤵
  PID:5932
- C:\Windows\System\MYQQclX.exe
  C:\Windows\System\MYQQclX.exe
  2⤵
  PID:5948
- C:\Windows\System\guLyXGM.exe
  C:\Windows\System\guLyXGM.exe
  2⤵
  PID:5968
- C:\Windows\System\ecACNFk.exe
  C:\Windows\System\ecACNFk.exe
  2⤵
  PID:5984
- C:\Windows\System\twAUiyJ.exe
  C:\Windows\System\twAUiyJ.exe
  2⤵
  PID:6004
- C:\Windows\System\wzAbmMZ.exe
  C:\Windows\System\wzAbmMZ.exe
  2⤵
  PID:6020
- C:\Windows\System\PydYOQT.exe
  C:\Windows\System\PydYOQT.exe
  2⤵
  PID:6040
- C:\Windows\System\hubNKBV.exe
  C:\Windows\System\hubNKBV.exe
  2⤵
  PID:6056
- C:\Windows\System\IiSQBNc.exe
  C:\Windows\System\IiSQBNc.exe
  2⤵
  PID:6076
- C:\Windows\System\yCDYvrh.exe
  C:\Windows\System\yCDYvrh.exe
  2⤵
  PID:6092
- C:\Windows\System\GsgAnXK.exe
  C:\Windows\System\GsgAnXK.exe
  2⤵
  PID:6112
- C:\Windows\System\EaGwbPj.exe
  C:\Windows\System\EaGwbPj.exe
  2⤵
  PID:6128
- C:\Windows\System\pcjYKjz.exe
  C:\Windows\System\pcjYKjz.exe
  2⤵
  PID:4436
- C:\Windows\System\SwStcTO.exe
  C:\Windows\System\SwStcTO.exe
  2⤵
  PID:5160
- C:\Windows\System\Ygcqqsu.exe
  C:\Windows\System\Ygcqqsu.exe
  2⤵
  PID:5224
- C:\Windows\System\WVRgqFg.exe
  C:\Windows\System\WVRgqFg.exe
  2⤵
  PID:5092
- C:\Windows\System\qWSqhEh.exe
  C:\Windows\System\qWSqhEh.exe
  2⤵
  PID:4884
- C:\Windows\System\DdpmIZc.exe
  C:\Windows\System\DdpmIZc.exe
  2⤵
  PID:4168
- C:\Windows\System\fSJaMec.exe
  C:\Windows\System\fSJaMec.exe
  2⤵
  PID:5292
- C:\Windows\System\vlEnLRB.exe
  C:\Windows\System\vlEnLRB.exe
  2⤵
  PID:5304
- C:\Windows\System\hfElfVM.exe
  C:\Windows\System\hfElfVM.exe
  2⤵
  PID:5180
- C:\Windows\System\TxarHUw.exe
  C:\Windows\System\TxarHUw.exe
  2⤵
  PID:5176
- C:\Windows\System\AaCZyCw.exe
  C:\Windows\System\AaCZyCw.exe
  2⤵
  PID:5324
- C:\Windows\System\wsmYLbW.exe
  C:\Windows\System\wsmYLbW.exe
  2⤵
  PID:5340
- C:\Windows\System\QXmmIHH.exe
  C:\Windows\System\QXmmIHH.exe
  2⤵
  PID:5356
- C:\Windows\System\kDBnBYX.exe
  C:\Windows\System\kDBnBYX.exe
  2⤵
  PID:4836
- C:\Windows\System\BkYXjTa.exe
  C:\Windows\System\BkYXjTa.exe
  2⤵
  PID:5632
- C:\Windows\System\kptZNfu.exe
  C:\Windows\System\kptZNfu.exe
  2⤵
  PID:5536
- C:\Windows\System\mCrdaKN.exe
  C:\Windows\System\mCrdaKN.exe
  2⤵
  PID:5604
- C:\Windows\System\dbDhcBN.exe
  C:\Windows\System\dbDhcBN.exe
  2⤵
  PID:5396
- C:\Windows\System\VgMEQcV.exe
  C:\Windows\System\VgMEQcV.exe
  2⤵
  PID:5780
- C:\Windows\System\lajFaSS.exe
  C:\Windows\System\lajFaSS.exe
  2⤵
  PID:5848
- C:\Windows\System\Fayyixq.exe
  C:\Windows\System\Fayyixq.exe
  2⤵
  PID:5828
- C:\Windows\System\caqTQja.exe
  C:\Windows\System\caqTQja.exe
  2⤵
  PID:5728
- C:\Windows\System\gSefBWP.exe
  C:\Windows\System\gSefBWP.exe
  2⤵
  PID:5792
- C:\Windows\System\asmUOMu.exe
  C:\Windows\System\asmUOMu.exe
  2⤵
  PID:5832
- C:\Windows\System\sYdktHR.exe
  C:\Windows\System\sYdktHR.exe
  2⤵
  PID:5904
- C:\Windows\System\UVFJOAv.exe
  C:\Windows\System\UVFJOAv.exe
  2⤵
  PID:5980
- C:\Windows\System\LEQfkZQ.exe
  C:\Windows\System\LEQfkZQ.exe
  2⤵
  PID:6052
- C:\Windows\System\atqLeIn.exe
  C:\Windows\System\atqLeIn.exe
  2⤵
  PID:5128
- C:\Windows\System\JGYdmzR.exe
  C:\Windows\System\JGYdmzR.exe
  2⤵
  PID:4792
- C:\Windows\System\NfvSygX.exe
  C:\Windows\System\NfvSygX.exe
  2⤵
  PID:5012
- C:\Windows\System\twFfqNL.exe
  C:\Windows\System\twFfqNL.exe
  2⤵
  PID:5336
- C:\Windows\System\hsRMtWe.exe
  C:\Windows\System\hsRMtWe.exe
  2⤵
  PID:5508
- C:\Windows\System\gMdEmfx.exe
  C:\Windows\System\gMdEmfx.exe
  2⤵
  PID:5384
- C:\Windows\System\hkQQwbV.exe
  C:\Windows\System\hkQQwbV.exe
  2⤵
  PID:5524
- C:\Windows\System\VSjILvh.exe
  C:\Windows\System\VSjILvh.exe
  2⤵
  PID:1236
- C:\Windows\System\UukqENf.exe
  C:\Windows\System\UukqENf.exe
  2⤵
  PID:5928
- C:\Windows\System\IvLUQEN.exe
  C:\Windows\System\IvLUQEN.exe
  2⤵
  PID:5616
- C:\Windows\System\EXUHRAu.exe
  C:\Windows\System\EXUHRAu.exe
  2⤵
  PID:5688
- C:\Windows\System\fQVuUyR.exe
  C:\Windows\System\fQVuUyR.exe
  2⤵
  PID:5240
- C:\Windows\System\cGLFtKY.exe
  C:\Windows\System\cGLFtKY.exe
  2⤵
  PID:5348
- C:\Windows\System\aCBgMkT.exe
  C:\Windows\System\aCBgMkT.exe
  2⤵
  PID:5568
- C:\Windows\System\OPboKXi.exe
  C:\Windows\System\OPboKXi.exe
  2⤵
  PID:5380
- C:\Windows\System\QMfnIqa.exe
  C:\Windows\System\QMfnIqa.exe
  2⤵
  PID:5424
- C:\Windows\System\yWbNJmk.exe
  C:\Windows\System\yWbNJmk.exe
  2⤵
  PID:5620
- C:\Windows\System\PUSHOtZ.exe
  C:\Windows\System\PUSHOtZ.exe
  2⤵
  PID:5744
- C:\Windows\System\kwemuIN.exe
  C:\Windows\System\kwemuIN.exe
  2⤵
  PID:5916
- C:\Windows\System\JDgmOkt.exe
  C:\Windows\System\JDgmOkt.exe
  2⤵
  PID:5196
- C:\Windows\System\CjujbhJ.exe
  C:\Windows\System\CjujbhJ.exe
  2⤵
  PID:5320
- C:\Windows\System\lerdlxQ.exe
  C:\Windows\System\lerdlxQ.exe
  2⤵
  PID:5944
- C:\Windows\System\mToAKVV.exe
  C:\Windows\System\mToAKVV.exe
  2⤵
  PID:4204
- C:\Windows\System\YlVVnai.exe
  C:\Windows\System\YlVVnai.exe
  2⤵
  PID:5392
- C:\Windows\System\XEptDmC.exe
  C:\Windows\System\XEptDmC.exe
  2⤵
  PID:5680
- C:\Windows\System\YNziPXs.exe
  C:\Windows\System\YNziPXs.exe
  2⤵
  PID:5992
- C:\Windows\System\SHhzzsU.exe
  C:\Windows\System\SHhzzsU.exe
  2⤵
  PID:5960
- C:\Windows\System\UAagdFG.exe
  C:\Windows\System\UAagdFG.exe
  2⤵
  PID:6068
- C:\Windows\System\ePzvMxI.exe
  C:\Windows\System\ePzvMxI.exe
  2⤵
  PID:6108
- C:\Windows\System\aDQPohy.exe
  C:\Windows\System\aDQPohy.exe
  2⤵
  PID:5312
- C:\Windows\System\KrziEMk.exe
  C:\Windows\System\KrziEMk.exe
  2⤵
  PID:5764
- C:\Windows\System\XUVOSjU.exe
  C:\Windows\System\XUVOSjU.exe
  2⤵
  PID:5704
- C:\Windows\System\FrIbkHt.exe
  C:\Windows\System\FrIbkHt.exe
  2⤵
  PID:5884
- C:\Windows\System\lMkDutx.exe
  C:\Windows\System\lMkDutx.exe
  2⤵
  PID:6088
- C:\Windows\System\wslyRJB.exe
  C:\Windows\System\wslyRJB.exe
  2⤵
  PID:5492
- C:\Windows\System\RZsgVHb.exe
  C:\Windows\System\RZsgVHb.exe
  2⤵
  PID:6000
- C:\Windows\System\rQbJiyA.exe
  C:\Windows\System\rQbJiyA.exe
  2⤵
  PID:5776
- C:\Windows\System\rYFWtNm.exe
  C:\Windows\System\rYFWtNm.exe
  2⤵
  PID:5088
- C:\Windows\System\UWEHlbm.exe
  C:\Windows\System\UWEHlbm.exe
  2⤵
  PID:6104
- C:\Windows\System\hNexaqS.exe
  C:\Windows\System\hNexaqS.exe
  2⤵
  PID:6160
- C:\Windows\System\gVEkDBX.exe
  C:\Windows\System\gVEkDBX.exe
  2⤵
  PID:6176
- C:\Windows\System\NyELbxF.exe
  C:\Windows\System\NyELbxF.exe
  2⤵
  PID:6192
- C:\Windows\System\mQegArd.exe
  C:\Windows\System\mQegArd.exe
  2⤵
  PID:6208
- C:\Windows\System\KtPPjcd.exe
  C:\Windows\System\KtPPjcd.exe
  2⤵
  PID:6224
- C:\Windows\System\nNdLuSZ.exe
  C:\Windows\System\nNdLuSZ.exe
  2⤵
  PID:6244
- C:\Windows\System\CGxVZZd.exe
  C:\Windows\System\CGxVZZd.exe
  2⤵
  PID:6260
- C:\Windows\System\tcPGRsr.exe
  C:\Windows\System\tcPGRsr.exe
  2⤵
  PID:6276
- C:\Windows\System\GFkjYJQ.exe
  C:\Windows\System\GFkjYJQ.exe
  2⤵
  PID:6292
- C:\Windows\System\BkNnkNz.exe
  C:\Windows\System\BkNnkNz.exe
  2⤵
  PID:6308
- C:\Windows\System\LBMyqBo.exe
  C:\Windows\System\LBMyqBo.exe
  2⤵
  PID:6324
- C:\Windows\System\zfzydKs.exe
  C:\Windows\System\zfzydKs.exe
  2⤵
  PID:6340
- C:\Windows\System\yBOlnmR.exe
  C:\Windows\System\yBOlnmR.exe
  2⤵
  PID:6356
- C:\Windows\System\SsMYvRR.exe
  C:\Windows\System\SsMYvRR.exe
  2⤵
  PID:6372
- C:\Windows\System\dGkJmfA.exe
  C:\Windows\System\dGkJmfA.exe
  2⤵
  PID:6388
- C:\Windows\System\jYVkiPe.exe
  C:\Windows\System\jYVkiPe.exe
  2⤵
  PID:6404
- C:\Windows\System\fJWezpD.exe
  C:\Windows\System\fJWezpD.exe
  2⤵
  PID:6420
- C:\Windows\System\EeFsVZq.exe
  C:\Windows\System\EeFsVZq.exe
  2⤵
  PID:6436
- C:\Windows\System\VNClnBX.exe
  C:\Windows\System\VNClnBX.exe
  2⤵
  PID:6452
- C:\Windows\System\QvTVayN.exe
  C:\Windows\System\QvTVayN.exe
  2⤵
  PID:6468
- C:\Windows\System\hvKFyZN.exe
  C:\Windows\System\hvKFyZN.exe
  2⤵
  PID:6484
- C:\Windows\System\PsjOgXj.exe
  C:\Windows\System\PsjOgXj.exe
  2⤵
  PID:6504
- C:\Windows\System\ahHDcsi.exe
  C:\Windows\System\ahHDcsi.exe
  2⤵
  PID:6520
- C:\Windows\System\PXrOJer.exe
  C:\Windows\System\PXrOJer.exe
  2⤵
  PID:6536
- C:\Windows\System\mJmNDxI.exe
  C:\Windows\System\mJmNDxI.exe
  2⤵
  PID:6552
- C:\Windows\System\TFEliZw.exe
  C:\Windows\System\TFEliZw.exe
  2⤵
  PID:6568
- C:\Windows\System\BVrMHQI.exe
  C:\Windows\System\BVrMHQI.exe
  2⤵
  PID:6584
- C:\Windows\System\fWfBcsj.exe
  C:\Windows\System\fWfBcsj.exe
  2⤵
  PID:6600
- C:\Windows\System\oifsoIG.exe
  C:\Windows\System\oifsoIG.exe
  2⤵
  PID:6616
- C:\Windows\System\cxbdvqR.exe
  C:\Windows\System\cxbdvqR.exe
  2⤵
  PID:6632
- C:\Windows\System\FLgOQhC.exe
  C:\Windows\System\FLgOQhC.exe
  2⤵
  PID:6648
- C:\Windows\System\yejJhoL.exe
  C:\Windows\System\yejJhoL.exe
  2⤵
  PID:6664
- C:\Windows\System\jxYhRga.exe
  C:\Windows\System\jxYhRga.exe
  2⤵
  PID:6680
- C:\Windows\System\CStnuap.exe
  C:\Windows\System\CStnuap.exe
  2⤵
  PID:6696
- C:\Windows\System\rghwgTB.exe
  C:\Windows\System\rghwgTB.exe
  2⤵
  PID:6712
- C:\Windows\System\xBYMMFo.exe
  C:\Windows\System\xBYMMFo.exe
  2⤵
  PID:6728
- C:\Windows\System\cpDypjs.exe
  C:\Windows\System\cpDypjs.exe
  2⤵
  PID:6744
- C:\Windows\System\sgIkCls.exe
  C:\Windows\System\sgIkCls.exe
  2⤵
  PID:6760
- C:\Windows\System\iSdFeiq.exe
  C:\Windows\System\iSdFeiq.exe
  2⤵
  PID:6776
- C:\Windows\System\knjpBCQ.exe
  C:\Windows\System\knjpBCQ.exe
  2⤵
  PID:6792
- C:\Windows\System\xWScSpb.exe
  C:\Windows\System\xWScSpb.exe
  2⤵
  PID:6808
- C:\Windows\System\BIisgov.exe
  C:\Windows\System\BIisgov.exe
  2⤵
  PID:6824
- C:\Windows\System\ERRTkHQ.exe
  C:\Windows\System\ERRTkHQ.exe
  2⤵
  PID:6840
- C:\Windows\System\fliteLN.exe
  C:\Windows\System\fliteLN.exe
  2⤵
  PID:6856
- C:\Windows\System\GQlFrEs.exe
  C:\Windows\System\GQlFrEs.exe
  2⤵
  PID:6872
- C:\Windows\System\HMejVQG.exe
  C:\Windows\System\HMejVQG.exe
  2⤵
  PID:6888
- C:\Windows\System\hxBhcuk.exe
  C:\Windows\System\hxBhcuk.exe
  2⤵
  PID:6904
- C:\Windows\System\jkXSoDY.exe
  C:\Windows\System\jkXSoDY.exe
  2⤵
  PID:6920
- C:\Windows\System\fEzwYVw.exe
  C:\Windows\System\fEzwYVw.exe
  2⤵
  PID:6936
- C:\Windows\System\CtdqnPJ.exe
  C:\Windows\System\CtdqnPJ.exe
  2⤵
  PID:6952
- C:\Windows\System\ZTmLBZc.exe
  C:\Windows\System\ZTmLBZc.exe
  2⤵
  PID:6968
- C:\Windows\System\dSPNglF.exe
  C:\Windows\System\dSPNglF.exe
  2⤵
  PID:6984
- C:\Windows\System\PEGdIcW.exe
  C:\Windows\System\PEGdIcW.exe
  2⤵
  PID:7000
- C:\Windows\System\wsoDInJ.exe
  C:\Windows\System\wsoDInJ.exe
  2⤵
  PID:7016
- C:\Windows\System\PYrQjzH.exe
  C:\Windows\System\PYrQjzH.exe
  2⤵
  PID:7032
- C:\Windows\System\OXJNBUI.exe
  C:\Windows\System\OXJNBUI.exe
  2⤵
  PID:7048
- C:\Windows\System\gBpxkfa.exe
  C:\Windows\System\gBpxkfa.exe
  2⤵
  PID:7064
- C:\Windows\System\UGjkwMv.exe
  C:\Windows\System\UGjkwMv.exe
  2⤵
  PID:7080
- C:\Windows\System\tuluTHu.exe
  C:\Windows\System\tuluTHu.exe
  2⤵
  PID:7096
- C:\Windows\System\BUvHMGg.exe
  C:\Windows\System\BUvHMGg.exe
  2⤵
  PID:7112
- C:\Windows\System\TjhjIPe.exe
  C:\Windows\System\TjhjIPe.exe
  2⤵
  PID:7128
- C:\Windows\System\UdamZGq.exe
  C:\Windows\System\UdamZGq.exe
  2⤵
  PID:7144
- C:\Windows\System\upYbaDg.exe
  C:\Windows\System\upYbaDg.exe
  2⤵
  PID:7160
- C:\Windows\System\TwMklEw.exe
  C:\Windows\System\TwMklEw.exe
  2⤵
  PID:6168
- C:\Windows\System\IGjwnhn.exe
  C:\Windows\System\IGjwnhn.exe
  2⤵
  PID:6232
- C:\Windows\System\CWfmmLJ.exe
  C:\Windows\System\CWfmmLJ.exe
  2⤵
  PID:6268
- C:\Windows\System\aBxFFzd.exe
  C:\Windows\System\aBxFFzd.exe
  2⤵
  PID:5504
- C:\Windows\System\IMDIlbZ.exe
  C:\Windows\System\IMDIlbZ.exe
  2⤵
  PID:6336
- C:\Windows\System\FxGvSNx.exe
  C:\Windows\System\FxGvSNx.exe
  2⤵
  PID:6396
- C:\Windows\System\sksoxkh.exe
  C:\Windows\System\sksoxkh.exe
  2⤵
  PID:6460
- C:\Windows\System\SGfsUxA.exe
  C:\Windows\System\SGfsUxA.exe
  2⤵
  PID:6064
- C:\Windows\System\cODpGNG.exe
  C:\Windows\System\cODpGNG.exe
  2⤵
  PID:5600
- C:\Windows\System\ZjtgSIs.exe
  C:\Windows\System\ZjtgSIs.exe
  2⤵
  PID:5668
- C:\Windows\System\CxEQaPE.exe
  C:\Windows\System\CxEQaPE.exe
  2⤵
  PID:5588
- C:\Windows\System\rVkGMAt.exe
  C:\Windows\System\rVkGMAt.exe
  2⤵
  PID:6500
- C:\Windows\System\lUeOGWf.exe
  C:\Windows\System\lUeOGWf.exe
  2⤵
  PID:6564
- C:\Windows\System\IixFaDH.exe
  C:\Windows\System\IixFaDH.exe
  2⤵
  PID:6592
- C:\Windows\System\xBtsIod.exe
  C:\Windows\System\xBtsIod.exe
  2⤵
  PID:6628
- C:\Windows\System\HcmFjkh.exe
  C:\Windows\System\HcmFjkh.exe
  2⤵
  PID:5256
- C:\Windows\System\jAVKbCT.exe
  C:\Windows\System\jAVKbCT.exe
  2⤵
  PID:6720
- C:\Windows\System\bGbHyCJ.exe
  C:\Windows\System\bGbHyCJ.exe
  2⤵
  PID:6444
- C:\Windows\System\bldSZME.exe
  C:\Windows\System\bldSZME.exe
  2⤵
  PID:6784
- C:\Windows\System\bsjNrFw.exe
  C:\Windows\System\bsjNrFw.exe
  2⤵
  PID:6156
- C:\Windows\System\NJGyVnj.exe
  C:\Windows\System\NJGyVnj.exe
  2⤵
  PID:5024
- C:\Windows\System\uBeNAub.exe
  C:\Windows\System\uBeNAub.exe
  2⤵
  PID:5444
- C:\Windows\System\SvnNNzI.exe
  C:\Windows\System\SvnNNzI.exe
  2⤵
  PID:5844
- C:\Windows\System\viVicLu.exe
  C:\Windows\System\viVicLu.exe
  2⤵
  PID:5924
- C:\Windows\System\QNsvoFz.exe
  C:\Windows\System\QNsvoFz.exe
  2⤵
  PID:6676
- C:\Windows\System\miGIeCY.exe
  C:\Windows\System\miGIeCY.exe
  2⤵
  PID:3036
- C:\Windows\System\cyLtdmI.exe
  C:\Windows\System\cyLtdmI.exe
  2⤵
  PID:6380
- C:\Windows\System\sqRHIDj.exe
  C:\Windows\System\sqRHIDj.exe
  2⤵
  PID:5964
- C:\Windows\System\MevnxWl.exe
  C:\Windows\System\MevnxWl.exe
  2⤵
  PID:6800
- C:\Windows\System\yoOQMVx.exe
  C:\Windows\System\yoOQMVx.exe
  2⤵
  PID:6548
- C:\Windows\System\bawKOed.exe
  C:\Windows\System\bawKOed.exe
  2⤵
  PID:6188
- C:\Windows\System\RfvxQSQ.exe
  C:\Windows\System\RfvxQSQ.exe
  2⤵
  PID:6220
- C:\Windows\System\kbZPKaD.exe
  C:\Windows\System\kbZPKaD.exe
  2⤵
  PID:6640
- C:\Windows\System\qEfGbSf.exe
  C:\Windows\System\qEfGbSf.exe
  2⤵
  PID:6912
- C:\Windows\System\YguiZaq.exe
  C:\Windows\System\YguiZaq.exe
  2⤵
  PID:6288
- C:\Windows\System\ZpRjwUB.exe
  C:\Windows\System\ZpRjwUB.exe
  2⤵
  PID:6944
- C:\Windows\System\BYurzNV.exe
  C:\Windows\System\BYurzNV.exe
  2⤵
  PID:7008
- C:\Windows\System\NETlUQF.exe
  C:\Windows\System\NETlUQF.exe
  2⤵
  PID:1656
- C:\Windows\System\Xhrjndc.exe
  C:\Windows\System\Xhrjndc.exe
  2⤵
  PID:6960
- C:\Windows\System\irFVijN.exe
  C:\Windows\System\irFVijN.exe
  2⤵
  PID:7136
- C:\Windows\System\QPXizFs.exe
  C:\Windows\System\QPXizFs.exe
  2⤵
  PID:6240
- C:\Windows\System\jXIiDFF.exe
  C:\Windows\System\jXIiDFF.exe
  2⤵
  PID:6428
- C:\Windows\System\wDCcxGt.exe
  C:\Windows\System\wDCcxGt.exe
  2⤵
  PID:5800
- C:\Windows\System\TJnHpzD.exe
  C:\Windows\System\TJnHpzD.exe
  2⤵
  PID:6624
- C:\Windows\System\VqvjoCX.exe
  C:\Windows\System\VqvjoCX.exe
  2⤵
  PID:5288
- C:\Windows\System\rmWWfDZ.exe
  C:\Windows\System\rmWWfDZ.exe
  2⤵
  PID:7024
- C:\Windows\System\JtkImfh.exe
  C:\Windows\System\JtkImfh.exe
  2⤵
  PID:6932
- C:\Windows\System\NhPHkmS.exe
  C:\Windows\System\NhPHkmS.exe
  2⤵
  PID:7156
- C:\Windows\System\NkYVtjE.exe
  C:\Windows\System\NkYVtjE.exe
  2⤵
  PID:1912
- C:\Windows\System\MWjfIhi.exe
  C:\Windows\System\MWjfIhi.exe
  2⤵
  PID:7092
- C:\Windows\System\tsbpobH.exe
  C:\Windows\System\tsbpobH.exe
  2⤵
  PID:6204
- C:\Windows\System\MfblHoa.exe
  C:\Windows\System\MfblHoa.exe
  2⤵
  PID:5376
- C:\Windows\System\brapmSz.exe
  C:\Windows\System\brapmSz.exe
  2⤵
  PID:1940
- C:\Windows\System\xcmhypl.exe
  C:\Windows\System\xcmhypl.exe
  2⤵
  PID:6768
- C:\Windows\System\cVzgTpf.exe
  C:\Windows\System\cVzgTpf.exe
  2⤵
  PID:6480
- C:\Windows\System\oKgrQoC.exe
  C:\Windows\System\oKgrQoC.exe
  2⤵
  PID:704
- C:\Windows\System\filcVqU.exe
  C:\Windows\System\filcVqU.exe
  2⤵
  PID:6320
- C:\Windows\System\vpvvDNA.exe
  C:\Windows\System\vpvvDNA.exe
  2⤵
  PID:7076
- C:\Windows\System\yNZvVhA.exe
  C:\Windows\System\yNZvVhA.exe
  2⤵
  PID:6048
- C:\Windows\System\CEoVkeA.exe
  C:\Windows\System\CEoVkeA.exe
  2⤵
  PID:6900
- C:\Windows\System\eVqJZGt.exe
  C:\Windows\System\eVqJZGt.exe
  2⤵
  PID:7028
- C:\Windows\System\JqSUYSc.exe
  C:\Windows\System\JqSUYSc.exe
  2⤵
  PID:5472
- C:\Windows\System\CAUvXvE.exe
  C:\Windows\System\CAUvXvE.exe
  2⤵
  PID:6740
- C:\Windows\System\YEHddoo.exe
  C:\Windows\System\YEHddoo.exe
  2⤵
  PID:6368
- C:\Windows\System\AtIimDG.exe
  C:\Windows\System\AtIimDG.exe
  2⤵
  PID:6976
- C:\Windows\System\wqqQzRp.exe
  C:\Windows\System\wqqQzRp.exe
  2⤵
  PID:6332
- C:\Windows\System\EszzftN.exe
  C:\Windows\System\EszzftN.exe
  2⤵
  PID:6788
- C:\Windows\System\MXVqDKt.exe
  C:\Windows\System\MXVqDKt.exe
  2⤵
  PID:6868
- C:\Windows\System\CVhSHLX.exe
  C:\Windows\System\CVhSHLX.exe
  2⤵
  PID:6644
- C:\Windows\System\EGlscRn.exe
  C:\Windows\System\EGlscRn.exe
  2⤵
  PID:7060
- C:\Windows\System\TLuZsrS.exe
  C:\Windows\System\TLuZsrS.exe
  2⤵
  PID:7040
- C:\Windows\System\ivSgQIh.exe
  C:\Windows\System\ivSgQIh.exe
  2⤵
  PID:6412
- C:\Windows\System\JvOoafu.exe
  C:\Windows\System\JvOoafu.exe
  2⤵
  PID:6348
- C:\Windows\System\LYJuHJo.exe
  C:\Windows\System\LYJuHJo.exe
  2⤵
  PID:6576
- C:\Windows\System\POQjBQm.exe
  C:\Windows\System\POQjBQm.exe
  2⤵
  PID:1148
- C:\Windows\System\Qhuadon.exe
  C:\Windows\System\Qhuadon.exe
  2⤵
  PID:6612
- C:\Windows\System\fvFssal.exe
  C:\Windows\System\fvFssal.exe
  2⤵
  PID:7108
- C:\Windows\System\socMegQ.exe
  C:\Windows\System\socMegQ.exe
  2⤵
  PID:7240
- C:\Windows\System\WuRtSlJ.exe
  C:\Windows\System\WuRtSlJ.exe
  2⤵
  PID:7272
- C:\Windows\System\NXAmevt.exe
  C:\Windows\System\NXAmevt.exe
  2⤵
  PID:7304
- C:\Windows\System\QskFpWV.exe
  C:\Windows\System\QskFpWV.exe
  2⤵
  PID:7328
- C:\Windows\System\hdnhfdM.exe
  C:\Windows\System\hdnhfdM.exe
  2⤵
  PID:7384
- C:\Windows\System\eEZibtd.exe
  C:\Windows\System\eEZibtd.exe
  2⤵
  PID:7408
- C:\Windows\System\PqnQKXS.exe
  C:\Windows\System\PqnQKXS.exe
  2⤵
  PID:7520
- C:\Windows\System\FtRNabD.exe
  C:\Windows\System\FtRNabD.exe
  2⤵
  PID:7568
- C:\Windows\System\KFSHQzX.exe
  C:\Windows\System\KFSHQzX.exe
  2⤵
  PID:7592
- C:\Windows\System\udeYqde.exe
  C:\Windows\System\udeYqde.exe
  2⤵
  PID:7612
- C:\Windows\System\DRMmSKA.exe
  C:\Windows\System\DRMmSKA.exe
  2⤵
  PID:7628
- C:\Windows\System\CprIGSc.exe
  C:\Windows\System\CprIGSc.exe
  2⤵
  PID:7644
- C:\Windows\System\vqKzwUY.exe
  C:\Windows\System\vqKzwUY.exe
  2⤵
  PID:7664
- C:\Windows\System\MQebdVX.exe
  C:\Windows\System\MQebdVX.exe
  2⤵
  PID:7680
- C:\Windows\System\gXxjoCr.exe
  C:\Windows\System\gXxjoCr.exe
  2⤵
  PID:7696
- C:\Windows\System\ogBLLcZ.exe
  C:\Windows\System\ogBLLcZ.exe
  2⤵
  PID:7836
- C:\Windows\System\boqutBS.exe
  C:\Windows\System\boqutBS.exe
  2⤵
  PID:7864
- C:\Windows\System\pBjEIEO.exe
  C:\Windows\System\pBjEIEO.exe
  2⤵
  PID:7880
- C:\Windows\System\NkCHxzy.exe
  C:\Windows\System\NkCHxzy.exe
  2⤵
  PID:7896
- C:\Windows\System\vEZhedX.exe
  C:\Windows\System\vEZhedX.exe
  2⤵
  PID:7912
- C:\Windows\System\vRSYRYx.exe
  C:\Windows\System\vRSYRYx.exe
  2⤵
  PID:7928
- C:\Windows\System\COMUDBS.exe
  C:\Windows\System\COMUDBS.exe
  2⤵
  PID:7944
- C:\Windows\System\DVonDuu.exe
  C:\Windows\System\DVonDuu.exe
  2⤵
  PID:7964
- C:\Windows\System\dUYJhcN.exe
  C:\Windows\System\dUYJhcN.exe
  2⤵
  PID:7980
- C:\Windows\System\BbfBsvl.exe
  C:\Windows\System\BbfBsvl.exe
  2⤵
  PID:7996
- C:\Windows\System\KhYaYXh.exe
  C:\Windows\System\KhYaYXh.exe
  2⤵
  PID:8012
- C:\Windows\System\uhqCrgS.exe
  C:\Windows\System\uhqCrgS.exe
  2⤵
  PID:8028
- C:\Windows\System\KZFralg.exe
  C:\Windows\System\KZFralg.exe
  2⤵
  PID:8044
- C:\Windows\System\TglcsLk.exe
  C:\Windows\System\TglcsLk.exe
  2⤵
  PID:8060
- C:\Windows\System\CHrerqJ.exe
  C:\Windows\System\CHrerqJ.exe
  2⤵
  PID:8080
- C:\Windows\System\bZDLbgU.exe
  C:\Windows\System\bZDLbgU.exe
  2⤵
  PID:8096
- C:\Windows\System\ShEWPPp.exe
  C:\Windows\System\ShEWPPp.exe
  2⤵
  PID:8112
- C:\Windows\System\LNIaXOw.exe
  C:\Windows\System\LNIaXOw.exe
  2⤵
  PID:8128
- C:\Windows\System\wCmYDAP.exe
  C:\Windows\System\wCmYDAP.exe
  2⤵
  PID:8144
- C:\Windows\System\lOicmJs.exe
  C:\Windows\System\lOicmJs.exe
  2⤵
  PID:8160
- C:\Windows\System\tPUIyrE.exe
  C:\Windows\System\tPUIyrE.exe
  2⤵
  PID:8176
- C:\Windows\System\iDGHIiF.exe
  C:\Windows\System\iDGHIiF.exe
  2⤵
  PID:7104
- C:\Windows\System\noxqiCL.exe
  C:\Windows\System\noxqiCL.exe
  2⤵
  PID:7188
- C:\Windows\System\QTKrhYU.exe
  C:\Windows\System\QTKrhYU.exe
  2⤵
  PID:7204
- C:\Windows\System\daZCyit.exe
  C:\Windows\System\daZCyit.exe
  2⤵
  PID:7216
- C:\Windows\System\EyfSEpa.exe
  C:\Windows\System\EyfSEpa.exe
  2⤵
  PID:6036
- C:\Windows\System\VZNNBtB.exe
  C:\Windows\System\VZNNBtB.exe
  2⤵
  PID:7172
- C:\Windows\System\pVBdDsg.exe
  C:\Windows\System\pVBdDsg.exe
  2⤵
  PID:6896
- C:\Windows\System\zxkHWpd.exe
  C:\Windows\System\zxkHWpd.exe
  2⤵
  PID:7228
- C:\Windows\System\TwfaFzb.exe
  C:\Windows\System\TwfaFzb.exe
  2⤵
  PID:7152
- C:\Windows\System\BChAokQ.exe
  C:\Windows\System\BChAokQ.exe
  2⤵
  PID:7268
- C:\Windows\System\FoFhgCS.exe
  C:\Windows\System\FoFhgCS.exe
  2⤵
  PID:7288
- C:\Windows\System\zvWyAJx.exe
  C:\Windows\System\zvWyAJx.exe
  2⤵
  PID:7312
- C:\Windows\System\OisGWQA.exe
  C:\Windows\System\OisGWQA.exe
  2⤵
  PID:7324
- C:\Windows\System\rrFMdBH.exe
  C:\Windows\System\rrFMdBH.exe
  2⤵
  PID:7348
- C:\Windows\System\FnDOVIv.exe
  C:\Windows\System\FnDOVIv.exe
  2⤵
  PID:7364
- C:\Windows\System\yJmoWnE.exe
  C:\Windows\System\yJmoWnE.exe
  2⤵
  PID:7380
- C:\Windows\System\KNDPzTL.exe
  C:\Windows\System\KNDPzTL.exe
  2⤵
  PID:7416
- C:\Windows\System\qTThdiA.exe
  C:\Windows\System\qTThdiA.exe
  2⤵
  PID:7440
- C:\Windows\System\vNvcpvu.exe
  C:\Windows\System\vNvcpvu.exe
  2⤵
  PID:7448
- C:\Windows\System\APLrweQ.exe
  C:\Windows\System\APLrweQ.exe
  2⤵
  PID:7464
- C:\Windows\System\iQqATIM.exe
  C:\Windows\System\iQqATIM.exe
  2⤵
  PID:7548
- C:\Windows\System\QMLiPTL.exe
  C:\Windows\System\QMLiPTL.exe
  2⤵
  PID:7560
- C:\Windows\System\ZKJLCuy.exe
  C:\Windows\System\ZKJLCuy.exe
  2⤵
  PID:7580
- C:\Windows\System\ITIvaeO.exe
  C:\Windows\System\ITIvaeO.exe
  2⤵
  PID:7584
- C:\Windows\System\JsXUwrN.exe
  C:\Windows\System\JsXUwrN.exe
  2⤵
  PID:7640
- C:\Windows\System\TBJFGwY.exe
  C:\Windows\System\TBJFGwY.exe
  2⤵
  PID:7480
- C:\Windows\System\nskbSOB.exe
  C:\Windows\System\nskbSOB.exe
  2⤵
  PID:7636
- C:\Windows\System\IGIAcZa.exe
  C:\Windows\System\IGIAcZa.exe
  2⤵
  PID:7536
- C:\Windows\System\hMsYfMT.exe
  C:\Windows\System\hMsYfMT.exe
  2⤵
  PID:7576
- C:\Windows\System\whXZWWz.exe
  C:\Windows\System\whXZWWz.exe
  2⤵
  PID:7740
- C:\Windows\System\iuXxPCD.exe
  C:\Windows\System\iuXxPCD.exe
  2⤵
  PID:7792
- C:\Windows\System\LOWIVjw.exe
  C:\Windows\System\LOWIVjw.exe
  2⤵
  PID:7392
- C:\Windows\System\cQFmhAv.exe
  C:\Windows\System\cQFmhAv.exe
  2⤵
  PID:7724
- C:\Windows\System\NkVsOSI.exe
  C:\Windows\System\NkVsOSI.exe
  2⤵
  PID:7752
- C:\Windows\System\cUWImpg.exe
  C:\Windows\System\cUWImpg.exe
  2⤵
  PID:7784
- C:\Windows\System\kVIyJPK.exe
  C:\Windows\System\kVIyJPK.exe
  2⤵
  PID:7808
- C:\Windows\System\qZskaHm.exe
  C:\Windows\System\qZskaHm.exe
  2⤵
  PID:6580
- C:\Windows\System\kjoXObY.exe
  C:\Windows\System\kjoXObY.exe
  2⤵
  PID:7280
- C:\Windows\System\sQrEWMl.exe
  C:\Windows\System\sQrEWMl.exe
  2⤵
  PID:7872
- C:\Windows\System\qdeJYTF.exe
  C:\Windows\System\qdeJYTF.exe
  2⤵
  PID:7372
- C:\Windows\System\WpLaqbq.exe
  C:\Windows\System\WpLaqbq.exe
  2⤵
  PID:7844
- C:\Windows\System\AbqSygo.exe
  C:\Windows\System\AbqSygo.exe
  2⤵
  PID:8052
- C:\Windows\System\Jbgqcbs.exe
  C:\Windows\System\Jbgqcbs.exe
  2⤵
  PID:7856
- C:\Windows\System\NGudaIV.exe
  C:\Windows\System\NGudaIV.exe
  2⤵
  PID:7892
- C:\Windows\System\hBmeglm.exe
  C:\Windows\System\hBmeglm.exe
  2⤵
  PID:8020
- C:\Windows\System\kvZBBjD.exe
  C:\Windows\System\kvZBBjD.exe
  2⤵
  PID:8120
- C:\Windows\System\hyHDYqS.exe
  C:\Windows\System\hyHDYqS.exe
  2⤵
  PID:8188
- C:\Windows\System\xTFXils.exe
  C:\Windows\System\xTFXils.exe
  2⤵
  PID:6216
- C:\Windows\System\myPGPUE.exe
  C:\Windows\System\myPGPUE.exe
  2⤵
  PID:7320
- C:\Windows\System\HmLLOMs.exe
  C:\Windows\System\HmLLOMs.exe
  2⤵
  PID:7404
- C:\Windows\System\AImbrxr.exe
  C:\Windows\System\AImbrxr.exe
  2⤵
  PID:7860
- C:\Windows\System\cgjoUns.exe
  C:\Windows\System\cgjoUns.exe
  2⤵
  PID:7496
- C:\Windows\System\xovAyav.exe
  C:\Windows\System\xovAyav.exe
  2⤵
  PID:7544
- C:\Windows\System\EYgtMeH.exe
  C:\Windows\System\EYgtMeH.exe
  2⤵
  PID:7476
- C:\Windows\System\BcMWybh.exe
  C:\Windows\System\BcMWybh.exe
  2⤵
  PID:7712
- C:\Windows\System\FfGAQzU.exe
  C:\Windows\System\FfGAQzU.exe
  2⤵
  PID:7760
- C:\Windows\System\tUlehtQ.exe
  C:\Windows\System\tUlehtQ.exe
  2⤵
  PID:7744
- C:\Windows\System\EJkbPuz.exe
  C:\Windows\System\EJkbPuz.exe
  2⤵
  PID:7776
- C:\Windows\System\hztgAyA.exe
  C:\Windows\System\hztgAyA.exe
  2⤵
  PID:7756
- C:\Windows\System\MRaXQwh.exe
  C:\Windows\System\MRaXQwh.exe
  2⤵
  PID:7816
- C:\Windows\System\QZirebj.exe
  C:\Windows\System\QZirebj.exe
  2⤵
  PID:8004
- C:\Windows\System\yBtUbqT.exe
  C:\Windows\System\yBtUbqT.exe
  2⤵
  PID:8104
- C:\Windows\System\lMRiRjD.exe
  C:\Windows\System\lMRiRjD.exe
  2⤵
  PID:7936
- C:\Windows\System\LlTrLwN.exe
  C:\Windows\System\LlTrLwN.exe
  2⤵
  PID:7848
- C:\Windows\System\jvAnvEF.exe
  C:\Windows\System\jvAnvEF.exe
  2⤵
  PID:1500
- C:\Windows\System\uJwBnNp.exe
  C:\Windows\System\uJwBnNp.exe
  2⤵
  PID:8108
- C:\Windows\System\KlUgeeb.exe
  C:\Windows\System\KlUgeeb.exe
  2⤵
  PID:8024
- C:\Windows\System\uhRiXNB.exe
  C:\Windows\System\uhRiXNB.exe
  2⤵
  PID:7600
- C:\Windows\System\pxxJFdS.exe
  C:\Windows\System\pxxJFdS.exe
  2⤵
  PID:6256
- C:\Windows\System\EoiuIWE.exe
  C:\Windows\System\EoiuIWE.exe
  2⤵
  PID:7504
- C:\Windows\System\pSPknsk.exe
  C:\Windows\System\pSPknsk.exe
  2⤵
  PID:7624
- C:\Windows\System\jmNCtRL.exe
  C:\Windows\System\jmNCtRL.exe
  2⤵
  PID:7336
- C:\Windows\System\ZXyFSDL.exe
  C:\Windows\System\ZXyFSDL.exe
  2⤵
  PID:7768
- C:\Windows\System\XspzIeK.exe
  C:\Windows\System\XspzIeK.exe
  2⤵
  PID:7456
- C:\Windows\System\dPesYvJ.exe
  C:\Windows\System\dPesYvJ.exe
  2⤵
  PID:7588
- C:\Windows\System\TGeZBjk.exe
  C:\Windows\System\TGeZBjk.exe
  2⤵
  PID:8076
- C:\Windows\System\XjLDiNH.exe
  C:\Windows\System\XjLDiNH.exe
  2⤵
  PID:7720
- C:\Windows\System\wRsmKYf.exe
  C:\Windows\System\wRsmKYf.exe
  2⤵
  PID:7732
- C:\Windows\System\XEUJPvU.exe
  C:\Windows\System\XEUJPvU.exe
  2⤵
  PID:7736
- C:\Windows\System\zUOKZoz.exe
  C:\Windows\System\zUOKZoz.exe
  2⤵
  PID:7708
- C:\Windows\System\drIbCZe.exe
  C:\Windows\System\drIbCZe.exe
  2⤵
  PID:7252
- C:\Windows\System\DvYSdWh.exe
  C:\Windows\System\DvYSdWh.exe
  2⤵
  PID:7400
- C:\Windows\System\lFUiCww.exe
  C:\Windows\System\lFUiCww.exe
  2⤵
  PID:7960
- C:\Windows\System\VHCJmQw.exe
  C:\Windows\System\VHCJmQw.exe
  2⤵
  PID:7200
- C:\Windows\System\ojPqoqA.exe
  C:\Windows\System\ojPqoqA.exe
  2⤵
  PID:8008
- C:\Windows\System\KpTDhgt.exe
  C:\Windows\System\KpTDhgt.exe
  2⤵
  PID:7656
- C:\Windows\System\sFJEKLF.exe
  C:\Windows\System\sFJEKLF.exe
  2⤵
  PID:7468
- C:\Windows\System\MeAWGiD.exe
  C:\Windows\System\MeAWGiD.exe
  2⤵
  PID:7888
- C:\Windows\System\ubIegBj.exe
  C:\Windows\System\ubIegBj.exe
  2⤵
  PID:7876
- C:\Windows\System\Ldqwpbv.exe
  C:\Windows\System\Ldqwpbv.exe
  2⤵
  PID:7444
- C:\Windows\System\oKonrUZ.exe
  C:\Windows\System\oKonrUZ.exe
  2⤵
  PID:7780
- C:\Windows\System\pOVbuHp.exe
  C:\Windows\System\pOVbuHp.exe
  2⤵
  PID:7264
- C:\Windows\System\xopuyfd.exe
  C:\Windows\System\xopuyfd.exe
  2⤵
  PID:8184
- C:\Windows\System\BksprFQ.exe
  C:\Windows\System\BksprFQ.exe
  2⤵
  PID:8208
- C:\Windows\System\ovnCpEc.exe
  C:\Windows\System\ovnCpEc.exe
  2⤵
  PID:8228
- C:\Windows\System\kYKLClv.exe
  C:\Windows\System\kYKLClv.exe
  2⤵
  PID:8244
- C:\Windows\System\VOiUWxL.exe
  C:\Windows\System\VOiUWxL.exe
  2⤵
  PID:8260
- C:\Windows\System\jqOcIiS.exe
  C:\Windows\System\jqOcIiS.exe
  2⤵
  PID:8276
- C:\Windows\System\LgQEJNz.exe
  C:\Windows\System\LgQEJNz.exe
  2⤵
  PID:8292
- C:\Windows\System\rjgplyL.exe
  C:\Windows\System\rjgplyL.exe
  2⤵
  PID:8308
- C:\Windows\System\OySWVWn.exe
  C:\Windows\System\OySWVWn.exe
  2⤵
  PID:8336
- C:\Windows\System\wvsKiOk.exe
  C:\Windows\System\wvsKiOk.exe
  2⤵
  PID:8352
- C:\Windows\System\AxrtjVR.exe
  C:\Windows\System\AxrtjVR.exe
  2⤵
  PID:8372
- C:\Windows\System\TYWyWVT.exe
  C:\Windows\System\TYWyWVT.exe
  2⤵
  PID:8392
- C:\Windows\System\jrYlfjj.exe
  C:\Windows\System\jrYlfjj.exe
  2⤵
  PID:8408
- C:\Windows\System\IgCVdmL.exe
  C:\Windows\System\IgCVdmL.exe
  2⤵
  PID:8428
- C:\Windows\System\YGOqEYF.exe
  C:\Windows\System\YGOqEYF.exe
  2⤵
  PID:8444
- C:\Windows\System\NGNxnwT.exe
  C:\Windows\System\NGNxnwT.exe
  2⤵
  PID:8460
- C:\Windows\System\RPPUJUA.exe
  C:\Windows\System\RPPUJUA.exe
  2⤵
  PID:8476
- C:\Windows\System\QVqabal.exe
  C:\Windows\System\QVqabal.exe
  2⤵
  PID:8492
- C:\Windows\System\IdLNVpF.exe
  C:\Windows\System\IdLNVpF.exe
  2⤵
  PID:8508
- C:\Windows\System\cCuZNep.exe
  C:\Windows\System\cCuZNep.exe
  2⤵
  PID:8528
- C:\Windows\System\KhaboFr.exe
  C:\Windows\System\KhaboFr.exe
  2⤵
  PID:8548
- C:\Windows\System\oyCluNo.exe
  C:\Windows\System\oyCluNo.exe
  2⤵
  PID:8564
- C:\Windows\System\KeWepZO.exe
  C:\Windows\System\KeWepZO.exe
  2⤵
  PID:8580
- C:\Windows\System\vnKiFAR.exe
  C:\Windows\System\vnKiFAR.exe
  2⤵
  PID:8604
- C:\Windows\System\JigJpMQ.exe
  C:\Windows\System\JigJpMQ.exe
  2⤵
  PID:8620
- C:\Windows\System\nWHwQRl.exe
  C:\Windows\System\nWHwQRl.exe
  2⤵
  PID:8636
- C:\Windows\System\MUOEvOg.exe
  C:\Windows\System\MUOEvOg.exe
  2⤵
  PID:8652
- C:\Windows\System\OrRxRWV.exe
  C:\Windows\System\OrRxRWV.exe
  2⤵
  PID:8668
- C:\Windows\System\sqLARQM.exe
  C:\Windows\System\sqLARQM.exe
  2⤵
  PID:8684
- C:\Windows\System\CrNNgMc.exe
  C:\Windows\System\CrNNgMc.exe
  2⤵
  PID:8704
- C:\Windows\System\BxXFMxK.exe
  C:\Windows\System\BxXFMxK.exe
  2⤵
  PID:8720
- C:\Windows\System\MCpzDLn.exe
  C:\Windows\System\MCpzDLn.exe
  2⤵
  PID:8736
- C:\Windows\System\jydyuDs.exe
  C:\Windows\System\jydyuDs.exe
  2⤵
  PID:8752
- C:\Windows\System\hrsBYJL.exe
  C:\Windows\System\hrsBYJL.exe
  2⤵
  PID:8768
- C:\Windows\System\IQxSyYu.exe
  C:\Windows\System\IQxSyYu.exe
  2⤵
  PID:8800
- C:\Windows\System\qrZunTG.exe
  C:\Windows\System\qrZunTG.exe
  2⤵
  PID:8816
- C:\Windows\System\UDgKmAV.exe
  C:\Windows\System\UDgKmAV.exe
  2⤵
  PID:8832
- C:\Windows\System\kbMqpeH.exe
  C:\Windows\System\kbMqpeH.exe
  2⤵
  PID:8848
- C:\Windows\System\endyCoa.exe
  C:\Windows\System\endyCoa.exe
  2⤵
  PID:8864
- C:\Windows\System\TxNBiAo.exe
  C:\Windows\System\TxNBiAo.exe
  2⤵
  PID:8880
- C:\Windows\System\TxznrvR.exe
  C:\Windows\System\TxznrvR.exe
  2⤵
  PID:8896
- C:\Windows\System\IylnxYr.exe
  C:\Windows\System\IylnxYr.exe
  2⤵
  PID:8912
- C:\Windows\System\UrNylWr.exe
  C:\Windows\System\UrNylWr.exe
  2⤵
  PID:8928
- C:\Windows\System\KPBhpSC.exe
  C:\Windows\System\KPBhpSC.exe
  2⤵
  PID:8944
- C:\Windows\System\JIUgMzj.exe
  C:\Windows\System\JIUgMzj.exe
  2⤵
  PID:8960
- C:\Windows\System\QXWMyUf.exe
  C:\Windows\System\QXWMyUf.exe
  2⤵
  PID:8976
- C:\Windows\System\DSZwfmR.exe
  C:\Windows\System\DSZwfmR.exe
  2⤵
  PID:8992
- C:\Windows\System\HqXbPEF.exe
  C:\Windows\System\HqXbPEF.exe
  2⤵
  PID:9008
- C:\Windows\System\wOqKDxF.exe
  C:\Windows\System\wOqKDxF.exe
  2⤵
  PID:9024
- C:\Windows\System\AiSXPhb.exe
  C:\Windows\System\AiSXPhb.exe
  2⤵
  PID:9040
- C:\Windows\System\wKhaCRU.exe
  C:\Windows\System\wKhaCRU.exe
  2⤵
  PID:9056
- C:\Windows\System\UKNQwJf.exe
  C:\Windows\System\UKNQwJf.exe
  2⤵
  PID:9072
- C:\Windows\System\yUyrRpa.exe
  C:\Windows\System\yUyrRpa.exe
  2⤵
  PID:9088
- C:\Windows\System\AsSAedV.exe
  C:\Windows\System\AsSAedV.exe
  2⤵
  PID:9104
- C:\Windows\System\INMsqzf.exe
  C:\Windows\System\INMsqzf.exe
  2⤵
  PID:9120
- C:\Windows\System\mXCqBBW.exe
  C:\Windows\System\mXCqBBW.exe
  2⤵
  PID:9136
- C:\Windows\System\ZEUCWwG.exe
  C:\Windows\System\ZEUCWwG.exe
  2⤵
  PID:9152
- C:\Windows\System\atZULCs.exe
  C:\Windows\System\atZULCs.exe
  2⤵
  PID:9168
- C:\Windows\System\veyTHgG.exe
  C:\Windows\System\veyTHgG.exe
  2⤵
  PID:9184
- C:\Windows\System\JkuNBfE.exe
  C:\Windows\System\JkuNBfE.exe
  2⤵
  PID:9200
- C:\Windows\System\MxrAJKl.exe
  C:\Windows\System\MxrAJKl.exe
  2⤵
  PID:7532
- C:\Windows\System\unoWpVS.exe
  C:\Windows\System\unoWpVS.exe
  2⤵
  PID:7688
- C:\Windows\System\ikWIPEo.exe
  C:\Windows\System\ikWIPEo.exe
  2⤵
  PID:8240
- C:\Windows\System\CkyYqQf.exe
  C:\Windows\System\CkyYqQf.exe
  2⤵
  PID:8348
- C:\Windows\System\kKOrzpx.exe
  C:\Windows\System\kKOrzpx.exe
  2⤵
  PID:8384
- C:\Windows\System\vqISqsv.exe
  C:\Windows\System\vqISqsv.exe
  2⤵
  PID:8416
- C:\Windows\System\MVXeVZA.exe
  C:\Windows\System\MVXeVZA.exe
  2⤵
  PID:7972
- C:\Windows\System\aZciacf.exe
  C:\Windows\System\aZciacf.exe
  2⤵
  PID:8252
- C:\Windows\System\krdmDrc.exe
  C:\Windows\System\krdmDrc.exe
  2⤵
  PID:8216
- C:\Windows\System\owsizdr.exe
  C:\Windows\System\owsizdr.exe
  2⤵
  PID:8320
- C:\Windows\System\ffYYHeX.exe
  C:\Windows\System\ffYYHeX.exe
  2⤵
  PID:8436
- C:\Windows\System\CSlCTYX.exe
  C:\Windows\System\CSlCTYX.exe
  2⤵
  PID:8516
- C:\Windows\System\JVdvisX.exe
  C:\Windows\System\JVdvisX.exe
  2⤵
  PID:8500
- C:\Windows\System\FbbyWDj.exe
  C:\Windows\System\FbbyWDj.exe
  2⤵
  PID:8588
- C:\Windows\System\HnETilX.exe
  C:\Windows\System\HnETilX.exe
  2⤵
  PID:8592
- C:\Windows\System\emWgnhy.exe
  C:\Windows\System\emWgnhy.exe
  2⤵
  PID:8612
- C:\Windows\System\aIDQksW.exe
  C:\Windows\System\aIDQksW.exe
  2⤵
  PID:8660
- C:\Windows\System\jJsJWTN.exe
  C:\Windows\System\jJsJWTN.exe
  2⤵
  PID:8700
- C:\Windows\System\xsGirrv.exe
  C:\Windows\System\xsGirrv.exe
  2⤵
  PID:8644
- C:\Windows\System\QrEzyXH.exe
  C:\Windows\System\QrEzyXH.exe
  2⤵
  PID:8712
- C:\Windows\System\aCcoHSV.exe
  C:\Windows\System\aCcoHSV.exe
  2⤵
  PID:8776
- C:\Windows\System\zWlUbrg.exe
  C:\Windows\System\zWlUbrg.exe
  2⤵
  PID:8808
- C:\Windows\System\aphNvvq.exe
  C:\Windows\System\aphNvvq.exe
  2⤵
  PID:8872
- C:\Windows\System\kzrLglP.exe
  C:\Windows\System\kzrLglP.exe
  2⤵
  PID:8936
- C:\Windows\System\wMQNtMz.exe
  C:\Windows\System\wMQNtMz.exe
  2⤵
  PID:8796
- C:\Windows\System\NEatdyc.exe
  C:\Windows\System\NEatdyc.exe
  2⤵
  PID:8888
- C:\Windows\System\qLNScGQ.exe
  C:\Windows\System\qLNScGQ.exe
  2⤵
  PID:8984
- C:\Windows\System\KSKFrdU.exe
  C:\Windows\System\KSKFrdU.exe
  2⤵
  PID:9000
- C:\Windows\System\QVeUqBs.exe
  C:\Windows\System\QVeUqBs.exe
  2⤵
  PID:9064
- C:\Windows\System\wMIDsyI.exe
  C:\Windows\System\wMIDsyI.exe
  2⤵
  PID:9128
- C:\Windows\System\GZFwFQN.exe
  C:\Windows\System\GZFwFQN.exe
  2⤵
  PID:9016
- C:\Windows\System\BTDXSuz.exe
  C:\Windows\System\BTDXSuz.exe
  2⤵
  PID:9052
- C:\Windows\System\tYMGlxs.exe
  C:\Windows\System\tYMGlxs.exe
  2⤵
  PID:8300
- C:\Windows\System\jnHSoeE.exe
  C:\Windows\System\jnHSoeE.exe
  2⤵
  PID:8388
- C:\Windows\System\SGGRIRI.exe
  C:\Windows\System\SGGRIRI.exe
  2⤵
  PID:9116
- C:\Windows\System\lAwxjuw.exe
  C:\Windows\System\lAwxjuw.exe
  2⤵
  PID:9148
- C:\Windows\System\LwpwLjY.exe
  C:\Windows\System\LwpwLjY.exe
  2⤵
  PID:9180
- C:\Windows\System\upZpDGk.exe
  C:\Windows\System\upZpDGk.exe
  2⤵
  PID:8420
- C:\Windows\System\icaZNlH.exe
  C:\Windows\System\icaZNlH.exe
  2⤵
  PID:7176
- C:\Windows\System\vHtZvrR.exe
  C:\Windows\System\vHtZvrR.exe
  2⤵
  PID:8332
- C:\Windows\System\sJjCpoe.exe
  C:\Windows\System\sJjCpoe.exe
  2⤵
  PID:8576
- C:\Windows\System\FuIJVPj.exe
  C:\Windows\System\FuIJVPj.exe
  2⤵
  PID:8364
- C:\Windows\System\LkFIvwG.exe
  C:\Windows\System\LkFIvwG.exe
  2⤵
  PID:8520
- C:\Windows\System\UTnRPNN.exe
  C:\Windows\System\UTnRPNN.exe
  2⤵
  PID:8524
- C:\Windows\System\wqqGihq.exe
  C:\Windows\System\wqqGihq.exe
  2⤵
  PID:8632
- C:\Windows\System\zHIpLXz.exe
  C:\Windows\System\zHIpLXz.exe
  2⤵
  PID:8844
- C:\Windows\System\sigFVow.exe
  C:\Windows\System\sigFVow.exe
  2⤵
  PID:8952
- C:\Windows\System\ayAtcYV.exe
  C:\Windows\System\ayAtcYV.exe
  2⤵
  PID:8988
- C:\Windows\System\mlpMENo.exe
  C:\Windows\System\mlpMENo.exe
  2⤵
  PID:9080
- C:\Windows\System\ZnrXOEa.exe
  C:\Windows\System\ZnrXOEa.exe
  2⤵
  PID:9208
- C:\Windows\System\fnGsGlp.exe
  C:\Windows\System\fnGsGlp.exe
  2⤵
  PID:7852
- C:\Windows\System\qIUqulJ.exe
  C:\Windows\System\qIUqulJ.exe
  2⤵
  PID:7908
- C:\Windows\System\QRmQiNB.exe
  C:\Windows\System\QRmQiNB.exe
  2⤵
  PID:9176
- C:\Windows\System\trfdASQ.exe
  C:\Windows\System\trfdASQ.exe
  2⤵
  PID:8328
- C:\Windows\System\YBfZzGL.exe
  C:\Windows\System\YBfZzGL.exe
  2⤵
  PID:8560
- C:\Windows\System\QXjCzcf.exe
  C:\Windows\System\QXjCzcf.exe
  2⤵
  PID:9228
- C:\Windows\System\BxoXHyS.exe
  C:\Windows\System\BxoXHyS.exe
  2⤵
  PID:9244
- C:\Windows\System\wzgFZgI.exe
  C:\Windows\System\wzgFZgI.exe
  2⤵
  PID:9268
- C:\Windows\System\AcOCifG.exe
  C:\Windows\System\AcOCifG.exe
  2⤵
  PID:9288
- C:\Windows\System\DFGNutD.exe
  C:\Windows\System\DFGNutD.exe
  2⤵
  PID:9304
- C:\Windows\System\WNCgWIv.exe
  C:\Windows\System\WNCgWIv.exe
  2⤵
  PID:9320
- C:\Windows\System\MIueQZb.exe
  C:\Windows\System\MIueQZb.exe
  2⤵
  PID:9336
- C:\Windows\System\VwjMezz.exe
  C:\Windows\System\VwjMezz.exe
  2⤵
  PID:9352
- C:\Windows\System\hNkdwaG.exe
  C:\Windows\System\hNkdwaG.exe
  2⤵
  PID:9368
- C:\Windows\System\cXhuQzQ.exe
  C:\Windows\System\cXhuQzQ.exe
  2⤵
  PID:9384
- C:\Windows\System\NpHSDjD.exe
  C:\Windows\System\NpHSDjD.exe
  2⤵
  PID:9400
- C:\Windows\System\bsPBXMZ.exe
  C:\Windows\System\bsPBXMZ.exe
  2⤵
  PID:9416
- C:\Windows\System\qazTbdo.exe
  C:\Windows\System\qazTbdo.exe
  2⤵
  PID:9436
- C:\Windows\System\LJgWuyY.exe
  C:\Windows\System\LJgWuyY.exe
  2⤵
  PID:9456
- C:\Windows\System\eLWumte.exe
  C:\Windows\System\eLWumte.exe
  2⤵
  PID:9476
- C:\Windows\System\VNIcKFy.exe
  C:\Windows\System\VNIcKFy.exe
  2⤵
  PID:9492
- C:\Windows\System\iNyxyAj.exe
  C:\Windows\System\iNyxyAj.exe
  2⤵
  PID:9508
- C:\Windows\System\MjYQwWB.exe
  C:\Windows\System\MjYQwWB.exe
  2⤵
  PID:9524
- C:\Windows\System\aAiyvna.exe
  C:\Windows\System\aAiyvna.exe
  2⤵
  PID:9540
- C:\Windows\System\VOzQZEz.exe
  C:\Windows\System\VOzQZEz.exe
  2⤵
  PID:9556
- C:\Windows\System\huGhrZB.exe
  C:\Windows\System\huGhrZB.exe
  2⤵
  PID:9572
- C:\Windows\System\UBoVgOJ.exe
  C:\Windows\System\UBoVgOJ.exe
  2⤵
  PID:9588
- C:\Windows\System\QCgNJxE.exe
  C:\Windows\System\QCgNJxE.exe
  2⤵
  PID:9604
- C:\Windows\System\qupougQ.exe
  C:\Windows\System\qupougQ.exe
  2⤵
  PID:9620
- C:\Windows\System\vDMNMCF.exe
  C:\Windows\System\vDMNMCF.exe
  2⤵
  PID:9636
- C:\Windows\System\GYFDRbF.exe
  C:\Windows\System\GYFDRbF.exe
  2⤵
  PID:9652
- C:\Windows\System\awxDVvu.exe
  C:\Windows\System\awxDVvu.exe
  2⤵
  PID:9668
- C:\Windows\System\QhBySzO.exe
  C:\Windows\System\QhBySzO.exe
  2⤵
  PID:9684
- C:\Windows\System\oRwvnNa.exe
  C:\Windows\System\oRwvnNa.exe
  2⤵
  PID:9700
- C:\Windows\System\KqeivPB.exe
  C:\Windows\System\KqeivPB.exe
  2⤵
  PID:9716
- C:\Windows\System\TuPqQKH.exe
  C:\Windows\System\TuPqQKH.exe
  2⤵
  PID:9732
- C:\Windows\System\BDfzHDm.exe
  C:\Windows\System\BDfzHDm.exe
  2⤵
  PID:9748
- C:\Windows\System\DgalXYe.exe
  C:\Windows\System\DgalXYe.exe
  2⤵
  PID:9764
- C:\Windows\System\kKhLhLb.exe
  C:\Windows\System\kKhLhLb.exe
  2⤵
  PID:9780
- C:\Windows\System\RLnKhSC.exe
  C:\Windows\System\RLnKhSC.exe
  2⤵
  PID:9796
- C:\Windows\System\TXKHWRs.exe
  C:\Windows\System\TXKHWRs.exe
  2⤵
  PID:9816
- C:\Windows\System\ReCDHJX.exe
  C:\Windows\System\ReCDHJX.exe
  2⤵
  PID:9832
- C:\Windows\System\bxwyVJy.exe
  C:\Windows\System\bxwyVJy.exe
  2⤵
  PID:9848
- C:\Windows\System\CsYXbcw.exe
  C:\Windows\System\CsYXbcw.exe
  2⤵
  PID:9864
- C:\Windows\System\QTcDZRw.exe
  C:\Windows\System\QTcDZRw.exe
  2⤵
  PID:9880
- C:\Windows\System\FCsAjrC.exe
  C:\Windows\System\FCsAjrC.exe
  2⤵
  PID:9896
- C:\Windows\System\Ylbgdfi.exe
  C:\Windows\System\Ylbgdfi.exe
  2⤵
  PID:9912
- C:\Windows\System\gIuNpbX.exe
  C:\Windows\System\gIuNpbX.exe
  2⤵
  PID:9928
- C:\Windows\System\lGhqECL.exe
  C:\Windows\System\lGhqECL.exe
  2⤵
  PID:9944
- C:\Windows\System\lrERxIE.exe
  C:\Windows\System\lrERxIE.exe
  2⤵
  PID:9968
- C:\Windows\System\KshQDKS.exe
  C:\Windows\System\KshQDKS.exe
  2⤵
  PID:9984
- C:\Windows\System\UlEqrnx.exe
  C:\Windows\System\UlEqrnx.exe
  2⤵
  PID:10004
- C:\Windows\System\gOruxYe.exe
  C:\Windows\System\gOruxYe.exe
  2⤵
  PID:10032
- C:\Windows\System\uXQkSgv.exe
  C:\Windows\System\uXQkSgv.exe
  2⤵
  PID:10048
- C:\Windows\System\IzAyLWM.exe
  C:\Windows\System\IzAyLWM.exe
  2⤵
  PID:10064
- C:\Windows\System\SmwiyKx.exe
  C:\Windows\System\SmwiyKx.exe
  2⤵
  PID:10168
- C:\Windows\System\eATDjUu.exe
  C:\Windows\System\eATDjUu.exe
  2⤵
  PID:10184
- C:\Windows\System\gRkXhah.exe
  C:\Windows\System\gRkXhah.exe
  2⤵
  PID:10200
- C:\Windows\System\dRCUHKm.exe
  C:\Windows\System\dRCUHKm.exe
  2⤵
  PID:10216
- C:\Windows\System\KrMCgTE.exe
  C:\Windows\System\KrMCgTE.exe
  2⤵
  PID:10232
- C:\Windows\System\ThgLeNB.exe
  C:\Windows\System\ThgLeNB.exe
  2⤵
  PID:8924
- C:\Windows\System\vZhsrTk.exe
  C:\Windows\System\vZhsrTk.exe
  2⤵
  PID:8956
- C:\Windows\System\htMfBQh.exe
  C:\Windows\System\htMfBQh.exe
  2⤵
  PID:8748
- C:\Windows\System\iEVJvQp.exe
  C:\Windows\System\iEVJvQp.exe
  2⤵
  PID:9252
- C:\Windows\System\kUWIJGS.exe
  C:\Windows\System\kUWIJGS.exe
  2⤵
  PID:9100
- C:\Windows\System\haOfIxY.exe
  C:\Windows\System\haOfIxY.exe
  2⤵
  PID:8504
- C:\Windows\System\kSCXTjg.exe
  C:\Windows\System\kSCXTjg.exe
  2⤵
  PID:8788
- C:\Windows\System\MiCqklp.exe
  C:\Windows\System\MiCqklp.exe
  2⤵
  PID:9296
- C:\Windows\System\gllaeHo.exe
  C:\Windows\System\gllaeHo.exe
  2⤵
  PID:9360
- C:\Windows\System\NnzUKdg.exe
  C:\Windows\System\NnzUKdg.exe
  2⤵
  PID:9424
- C:\Windows\System\JEIHasH.exe
  C:\Windows\System\JEIHasH.exe
  2⤵
  PID:9468
- C:\Windows\System\wazcmZl.exe
  C:\Windows\System\wazcmZl.exe
  2⤵
  PID:9504
- C:\Windows\System\eCTESYm.exe
  C:\Windows\System\eCTESYm.exe
  2⤵
  PID:9568
- C:\Windows\System\bMnSZUj.exe
  C:\Windows\System\bMnSZUj.exe
  2⤵
  PID:9600
- C:\Windows\System\bsJNIgH.exe
  C:\Windows\System\bsJNIgH.exe
  2⤵
  PID:9664
- C:\Windows\System\viZHBGD.exe
  C:\Windows\System\viZHBGD.exe
  2⤵
  PID:9488
- C:\Windows\System\PvUjbaZ.exe
  C:\Windows\System\PvUjbaZ.exe
  2⤵
  PID:9760
- C:\Windows\System\SuQcLld.exe
  C:\Windows\System\SuQcLld.exe
  2⤵
  PID:9316
- C:\Windows\System\NwyksdI.exe
  C:\Windows\System\NwyksdI.exe
  2⤵
  PID:9408
- C:\Windows\System\YcKozPL.exe
  C:\Windows\System\YcKozPL.exe
  2⤵
  PID:9452
- C:\Windows\System\UcPObSm.exe
  C:\Windows\System\UcPObSm.exe
  2⤵
  PID:9516
- C:\Windows\System\SyZDhgj.exe
  C:\Windows\System\SyZDhgj.exe
  2⤵
  PID:9888
- C:\Windows\System\OpPGyyB.exe
  C:\Windows\System\OpPGyyB.exe
  2⤵
  PID:9952
- C:\Windows\System\DjLzpjq.exe
  C:\Windows\System\DjLzpjq.exe
  2⤵
  PID:9552
- C:\Windows\System\VtKXxEn.exe
  C:\Windows\System\VtKXxEn.exe
  2⤵
  PID:9676
- C:\Windows\System\PYiNNWF.exe
  C:\Windows\System\PYiNNWF.exe
  2⤵
  PID:10040
- C:\Windows\System\CysSgSP.exe
  C:\Windows\System\CysSgSP.exe
  2⤵
  PID:9644
- C:\Windows\System\adppVcs.exe
  C:\Windows\System\adppVcs.exe
  2⤵
  PID:9740
- C:\Windows\System\dMkcPbM.exe
  C:\Windows\System\dMkcPbM.exe
  2⤵
  PID:10076
- C:\Windows\System\rfcLQVz.exe
  C:\Windows\System\rfcLQVz.exe
  2⤵
  PID:9840
- C:\Windows\System\KmcmgWn.exe
  C:\Windows\System\KmcmgWn.exe
  2⤵
  PID:10060
- C:\Windows\System\dTgJQzx.exe
  C:\Windows\System\dTgJQzx.exe
  2⤵
  PID:9876
- C:\Windows\System\VOnncOr.exe
  C:\Windows\System\VOnncOr.exe
  2⤵
  PID:9940
- C:\Windows\System\CHUvAEF.exe
  C:\Windows\System\CHUvAEF.exe
  2⤵
  PID:9980
- C:\Windows\System\DfdXdOV.exe
  C:\Windows\System\DfdXdOV.exe
  2⤵
  PID:10108
- C:\Windows\System\tnkYBjK.exe
  C:\Windows\System\tnkYBjK.exe
  2⤵
  PID:8456
- C:\Windows\System\YFyWcAx.exe
  C:\Windows\System\YFyWcAx.exe
  2⤵
  PID:10128
- C:\Windows\System\ygQGxnE.exe
  C:\Windows\System\ygQGxnE.exe
  2⤵
  PID:10156
- C:\Windows\System\irROoHX.exe
  C:\Windows\System\irROoHX.exe
  2⤵
  PID:10176
- C:\Windows\System\UlEzAFP.exe
  C:\Windows\System\UlEzAFP.exe
  2⤵
  PID:10228
- C:\Windows\System\zyarIjw.exe
  C:\Windows\System\zyarIjw.exe
  2⤵
  PID:9220
- C:\Windows\System\WQkEFBp.exe
  C:\Windows\System\WQkEFBp.exe
  2⤵
  PID:8268
- C:\Windows\System\ZHRtJPE.exe
  C:\Windows\System\ZHRtJPE.exe
  2⤵
  PID:9392
- C:\Windows\System\xHIyaxe.exe
  C:\Windows\System\xHIyaxe.exe
  2⤵
  PID:9284
- C:\Windows\System\ijWHnso.exe
  C:\Windows\System\ijWHnso.exe
  2⤵
  PID:9312
- C:\Windows\System\jjnfgQH.exe
  C:\Windows\System\jjnfgQH.exe
  2⤵
  PID:10212
- C:\Windows\System\FGMhOsz.exe
  C:\Windows\System\FGMhOsz.exe
  2⤵
  PID:8360
- C:\Windows\System\OsrqOHM.exe
  C:\Windows\System\OsrqOHM.exe
  2⤵
  PID:9256
- C:\Windows\System\CbcbOpW.exe
  C:\Windows\System\CbcbOpW.exe
  2⤵
  PID:8908
- C:\Windows\System\HgzKElt.exe
  C:\Windows\System\HgzKElt.exe
  2⤵
  PID:8972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BYIzJam.exe

Filesize
2.1MB

MD5
35f291019a08c8c3486e5b6aeda28009

SHA1
a9ddada49f757e45ed79e10a533c3789348dad5a

SHA256
ecd6aa7c8d4f9f854fce9cd7967c9b316ffb5e52e5b5c8a097994c3e4d2e4ce8

SHA512
cecbcf52d17e3e0de6c24191f50f995de395ac93c1ba5b910118de8eecc9c06029370b392321f8941852f828bc02f46d10ee700482d67409338de7b616ca0f89

Download Submit
C:\Windows\system\CIXhVoC.exe

Filesize
2.1MB

MD5
c08df79710d853d22fac48d96f109279

SHA1
d71859a7254f94f5098b94454afd71851854f774

SHA256
0da90f659ad1a964e6d70ca2f2eac7e5f92f3011fd33308a6e049a8f5d50df80

SHA512
f257f1a2d1620a3cba5a2d3cbdb442c768658a27eafaf7d6d32d491899d7a4257794f0583f90121b53874331f69f3ca503e51cc973de84fc7542e8c9d2378451

Download Submit
C:\Windows\system\CjybSJq.exe

Filesize
2.2MB

MD5
6923585076bd15f4e5fa8d8abf2176eb

SHA1
f1f8881b40c33e72fc7ad4804a84a01708c3d916

SHA256
b203c5d179f4938b4b3c589ddf884be272172fa6e3aa2fe84a01984826c04086

SHA512
1c83bfbbe03f601db106d0ad76a5c491e83a23902f251c91db6149d31f39ea25c3e3aab966b3baa5d5d21e1d2783b75581fe4e8b4aa30050fcd375f5ca2bb7f1

Download Submit
C:\Windows\system\DRnoWpl.exe

Filesize
2.1MB

MD5
7fdc400a1dd2f9eab530c0d311ef509c

SHA1
f0f81b966a98cbe9564f70031b2f49cc9217c5c7

SHA256
8d0de4f7d647688cdd1b87d66d19ccada07a565e3fd99830c4a30be49199b134

SHA512
c76ad775446f5c65ee934294809765d902b1932c53994131ebfb96086cbf27f6c417a7017b192ee525fb0f5334e648500fdee8ddd196c013fc7c3acfeb37fe30

Download Submit
C:\Windows\system\EQlyKVV.exe

Filesize
2.1MB

MD5
4bec2cc9b25f322377c47edbedc21b99

SHA1
eb02bbb53fbfcfd391c0ada2880f3ae895ed5430

SHA256
5990369c6f041c184e45d7f147d12169feedfb69073b5b1a73020c39a9cabae2

SHA512
22a484a0fe0f44cfbba9ee254d08e7d9566fe4fd16bb1373740116f53afa045e54c072c8329d3e8599312e37e5d69194aea7d109e2aaa771914c94fd8b8fd60b

Download Submit
C:\Windows\system\EtbUNEz.exe

Filesize
2.2MB

MD5
952c0d79621d9300e01db9c9fbe83a77

SHA1
d663995f979215a537b860b2355c69215c4f08e3

SHA256
8d26c003721a1fd7ef4a9967790b0b8ce3c36492cd54457abacb691841ba27a2

SHA512
35bbf67a4f214b30c0ac17c508ebea741b5c3591e9e177394f8609b438ba41922b450061df879b610b1e3680621ba82d04446a5b3ebdb437dc0695a83c5a6295

Download Submit
C:\Windows\system\IFHmjoW.exe

Filesize
2.1MB

MD5
83bfce96289d3c8da20ee883121aaf20

SHA1
6d8f0a72680b0473065c71afd841c71d75620522

SHA256
ee1c20c9bafc3f22ffc84f1c78c57536549d414de4e8347221b561ff8b0eb6f6

SHA512
dc7a3735eeb2d3deb0fbd6d9856a25808965c276a448e5313402d38552529c1eb207d0b7562457aeb2aac06529d324839c84319a1942f542fc6df585384b936b

Download Submit
C:\Windows\system\NnyZYWv.exe

Filesize
2.1MB

MD5
f1aafdfdfea6aaeb741d0f0e150f53ce

SHA1
c3d0cc60bd90945fecc6a2ab1bf858a1485b46fb

SHA256
b3e059c6a269ef3d5e81773999a2a8da9951ab8d9eaaeb7b62d6c62b34139e45

SHA512
7f0c8fd307cbda7fb6f99961c404d305d2de2d69d305910e68cf991f3e3bf1f5e682143355ed4931d7349b9000ff6ddc9b7dd3166fa74514ac82c01b2c0a4b20

Download Submit
C:\Windows\system\PtRHPoM.exe

Filesize
2.2MB

MD5
1cd2a8b5a2579567ff4c4703805cae39

SHA1
1455e7c62f9093e62b724ed9ebc64ab965c54d7f

SHA256
c6fdcbdf222c60aee6f1717a0f81e326167e422cebaf1c0b6087088f8d924a3a

SHA512
90053a80b18e2fc7c0f93c1283a4bca90f097116912a1f09883a1206bcbf45181b832309b2790b0d50e5dc0f6779ec641f1e377b5a78514fca8fe52a811f1562

Download Submit
C:\Windows\system\YsyAxEu.exe

Filesize
2.1MB

MD5
d4b089abd47c1b0d438342bad655636c

SHA1
bdf1e5cca495d69f805b552400dd58b998b069b6

SHA256
3242de9736fbd563071ccfcec9c4e08f22f4e989b23347e806f6df44b0e11904

SHA512
3b166d7706da4cd7bdcb3e3d834bd5588e3fd8ad0828d18982121c08436bd1840d0a728926a769aedcf067f6bd36bc78c6c7f0e4b5891622da2da7841cc8634e

Download Submit
C:\Windows\system\ZXOPGsC.exe

Filesize
2.2MB

MD5
86c1ad686920598ee342fc5f50d0bcc8

SHA1
ecd4f025065e42ab799cd45f31e8f89aa6206762

SHA256
d9e52715eb678e8992958e16247fe552322c3b0754dddf48daf7977e9b30e35d

SHA512
0c90ffc6d946a80a706302819459fe28b9571b9830e943943ffff1f0b5f8ed06eb52c269dc3578f71f3bb40d47f4729910d311f697e9288b07df057b640e86fa

Download Submit
C:\Windows\system\ZmibNPx.exe

Filesize
2.1MB

MD5
84e47afa339501a6e32de55a60bfe787

SHA1
2b7230c0983c71422b41b0e9d0ef0638dd3f8af4

SHA256
9a44db0a49de5250e97911243743c3f91dda4f3f53f17729cfdfa8017af70bb1

SHA512
d5f6f310cb34ec938a57f24bb9b7c932c567aedf498f649bc0796319dcaa408d8804d97571407e44e398c4c3023f53f9fba4479c37ddf3ea815cbd7c79ea6616

Download Submit
C:\Windows\system\aeidEaY.exe

Filesize
2.2MB

MD5
76be32af3a1e8c7b962486a28e2e684d

SHA1
2e38d5feea6e6a05a2d103e50ea7d4d14b5bc80a

SHA256
d6dbefc0eedbd017905b6795d060bd39d61dcc8905b0e04e696d1c2dd6db2e58

SHA512
1989b2ee6b079d652b345874a0e201f8817eae4b2ad12711dda5d2bdd7a32ede9dc0cd906156da3673f3962581b71a5b4b23b1460314b3b133ab1a59d728245b

Download Submit
C:\Windows\system\bYiKNJw.exe

Filesize
2.2MB

MD5
623a25caff3b3dcd5a5cec6d480ce7d8

SHA1
40700e04146532fbc6a1f5d699327b793368975b

SHA256
bef8e98b1961a43275b8be5a9cc74f3945e525553a94553c8e7bfdfd9204d189

SHA512
2993db2b6f80b80369543f2e17c6f4b5573451cfa86af66672834ae78064a75b911d7571ed153775c83fb78e6fb30bfd858b123790cd973adcb3c4bd0191364e

Download Submit
C:\Windows\system\ejrzsxP.exe

Filesize
2.1MB

MD5
2383b7cd27724f1d825da55da09d8ece

SHA1
a2d56124deda98e9f82f90ae1b75a238522ca413

SHA256
20451a7a859799992a59f8b4ad1936976a0c9d66510fd4bdc86e191ea55e23e4

SHA512
311a924cd8e521e58a422d286a5fc0023d0a12a6f8a4fb345f93df26b9444ce8ad221845b515a4efd678dfd62f62903004edfb59f03b4eff9876b948fafa3b1f

Download Submit
C:\Windows\system\hTDPMJr.exe

Filesize
2.1MB

MD5
0827477e98643296f8dc7df69d698612

SHA1
aef4436b9cdfea5c64d9bf37021a2d56aa730653

SHA256
d7604a9ad4376c8a9bd6b92c05b3a884133fa426d6fa2faca6e2808e678e6b99

SHA512
1b446c371ef3e06279c02302d24a0b46f1731004fdb40b934863014dee1fb353f57d45f2892087f364d7c6025f4470a9f587b39d1728a250408d3127dbe3a3d3

Download Submit
C:\Windows\system\jWumnaU.exe

Filesize
2.1MB

MD5
078bd4153f87900ffec11b4dadd041a9

SHA1
5f46d2c167dc89f854f71c31a4888902b1945b82

SHA256
dc7e7e93cce3b6bde92deb3dc7fa2c966ed27bda5bd253fed5617e3b7928a9d7

SHA512
db1597966307955d21222fb0015eb93fd746e81a48e3ff55ba9c00f6bad0e5d02684d3ed6793a31cc28aa95964422b393461c08996b7566c1dd3ff6c0038724a

Download Submit
C:\Windows\system\kLMOfTx.exe

Filesize
2.2MB

MD5
daf1a55d5c47dd66786cea9811a86d21

SHA1
047b3d896992b5ab0105d58a1654e66c837cac23

SHA256
5f3b5cf7c2c8d791860d83666ae61c5833de367bc48731e4700e94dbd93657ca

SHA512
e5478608427704d1d64bdc8a6de13fb4493fda8c137ced5634688ac008f9904aef4fa96485f4f6f50412cf909282f20ee9dccd60bc59c14b56a9377cef943164

Download Submit
C:\Windows\system\moGVwRf.exe

Filesize
2.1MB

MD5
8ccdf1c67621ee70fed12d18cb982de4

SHA1
a643b014788476a97b6218077e5d6a092a43f2a9

SHA256
42bba0abf246425544f6f6f411d59683a64d11087269e5c016376bc3a95819ed

SHA512
c3879c04e94cc9ed0f8d63557d69491f3c7e8d57e8b5188121b6b107841c1daf0d242fb0a5373885f522f1d550ccb6038f302ee1b4e52ad1c49bf7fef41d19e0

Download Submit
C:\Windows\system\odwdcTy.exe

Filesize
2.2MB

MD5
1536b8649abe01384bf938b494edfd57

SHA1
55b4674627997a439fd7bcd7fa45c26cdf1a423c

SHA256
db5e8a77c3b4252ec61b3761ca615301af16d8a853ee88568861a8fa0645816e

SHA512
ff1beffe1b613c4d6b3bb7493cc93bfe6a37d23becc5ee50759cdc1ac0c3e1a18b2dd2783ce89894a0790cce6cc10ad980787f7647e46bd576aed87aa10b497c

Download Submit
C:\Windows\system\pxiPCAr.exe

Filesize
2.1MB

MD5
f72b62b012ac1aa32916efa2046c3501

SHA1
fe5e95dc30d1f01770c87e3c6138e35c4a8b4c61

SHA256
6454a45b30dc501905bbb2533621128f7986dbaa748f515dd78e5ac65dbb084e

SHA512
dfd77f8b4ef497c17c681442b585659f278becb806949fe11a0d340141ea46cea9d3c93fe905a6255204dcc2076c8840a2f31953630aac75223c8dc2f95baf3b

Download Submit
C:\Windows\system\qbxesro.exe

Filesize
2.2MB

MD5
e3cb13cebdd3b2099eddc26404aa519d

SHA1
e24294a5cc14791aff7a74c76fdef942d1096b6d

SHA256
df1c85da931f15c6ecf62babe53bc7385b066690f09a3ce22a0774f6981ff3cd

SHA512
25e25dbbb492ac0c88ab6b27d0944d2f0a8ae6c4c5897963cabd269ca8b5f41905b28337b0456c28a44047af6b84d499ed28a53f6faa2eabce0eebb57615c0c6

Download Submit
C:\Windows\system\sDXitZr.exe

Filesize
2.2MB

MD5
6196f4dae9ad2db19aa8f8becc8307db

SHA1
b291b504f0d59364a97e627c12c79e22f4bac1a8

SHA256
f2889fb823d64b755fb763cc04d4a07b5d793814ac9aebcf5d79513459c8d268

SHA512
be3774350abd8a63a220d9668325b9630b08dbc0dd45cf62d45828d6323c8ec566ccc66b7229c0cca1a188bc4249fb3f5b9f6f42770ceb9f62bd84babd7280e3

Download Submit
C:\Windows\system\tDcnPfB.exe

Filesize
2.2MB

MD5
d909de408e804371cf888d2e6a5faac0

SHA1
5bcabfa342a81476ff405348b8ac55215bda90f3

SHA256
c959193118d4682509738191cb235e1065ed6ee169eb9fdf5c31fd4fc3a48e27

SHA512
77bffd70a6569fdb3f2decc844ff9edbc08f4cbdce7e8e8bcbdff0e12437534fd365f1c62d34271dd45017fac36e3fa1f81e950b16ae34b39bccb634d4bdaf17

Download Submit
C:\Windows\system\vOvPQEN.exe

Filesize
2.2MB

MD5
399e622c16a3863ee7328e24e9b01343

SHA1
2978d1188522de7e1fc25df2eb84ab617faaf699

SHA256
a9e398ca5326efee1cb67493d0eac877fbb07c7dd054054e0bdb387cfd1c9f81

SHA512
a1b90b1f7d0646e6e4c1bf73a90b1e40cc93cd7e3a2057d42bb3597e948bf6ba65d54bd0b4198030502fd09b6013045e8396b1486341cb8ef85dbf6049567734

Download Submit
C:\Windows\system\wCFayIH.exe

Filesize
2.2MB

MD5
89619465fd2efa6257b4841c605a7daa

SHA1
bf7c53da391ac57efb81ab673971d68901a10c69

SHA256
0b3073e5c665d1092928da3bddb175834f66cdb9f6f9e5d16e8176b31433e748

SHA512
0aaf1cd077dd0a48fdda83af93f3e173c8e920a435f7772671e48ee2f63d90d3f9a6365a7053c14eaba6e1ebdc1b86326431700220e85249d08c04ec00f6b955

Download Submit
C:\Windows\system\wtzCKMm.exe

Filesize
2.2MB

MD5
b835cd3f196dc0aea4de475f0601dbd5

SHA1
aa5cdd725469d745ed2146d290f16c5ee108f5ec

SHA256
f48e90bec108dbaa7db93d92e1af86eb3be407e9dbc6402b830d0ed2fb95f906

SHA512
5001a9c519b2789d8ebe57a4030d14ec2c6e40080f3c2a27f34fba33e6e2c1e2991b962dea4f73546af6fa1e4ad79f5e0656aa9024e63be0e23afbcf2afe2258

Download Submit
C:\Windows\system\xLFhfGK.exe

Filesize
2.2MB

MD5
4cf9ed8b1349c0efae5cbc29338f2a8b

SHA1
f6e12561396e8bb090a9a1dbf39160b7678ce85a

SHA256
d14f0c3eaa1e84ea71f5544bbcd89d5cff5d630c37910a1047861807ab632139

SHA512
97745eb8771611276d4847be416dc1697306bddfeaa2a176d7144042f4a01bed96e787ac8cea61752843013757f86826eb7515a67c195dff7a846c427c65deb0

Download Submit
\Windows\system\FmDmgZX.exe

Filesize
2.1MB

MD5
12993cafb708ff90e546c1f920eb5b5e

SHA1
8a0f6a13574e62f133594770ae0e1b9745a83d76

SHA256
d7d2c6de758a38a19215ab4466abcf646cf0782b2337522d216fbe20ac2812b2

SHA512
992ad616059b307a253f7e1f95e1161fdd8d5fe9cc9b0583512b1a496e8d77c2fbb65457966b961ace559790607cde8362512a1d23220cca946ee651eb85e967

Download Submit
\Windows\system\SScrMyp.exe

Filesize
2.2MB

MD5
d104df27d29cd0464c01ca2a3dad1d70

SHA1
d4570eaae1ae378edfb2f79fc3eb3cf14d5aa0a5

SHA256
d443fb0116416099023c7ac244dd2959300587347630ff1e48629dddd1412ad2

SHA512
f28c98bda3e500dd52750c30569238c739acb69ba7b6c02a943bce8d824e3509907151084151e35270b572349d08acd47ce3b400a5a4a1e5a6fecd64b54cf1ed

Download Submit
\Windows\system\SsNcmkT.exe

Filesize
2.1MB

MD5
507dacf826dc7328ce3df23c141e9ca7

SHA1
e0d36182db99680aec9241ac20b73e923371c5d2

SHA256
2725603731a8d6ad0d920fd82f5a9b228c56d602850bf442e226228eaaad7919

SHA512
1cd39f654df7abf6004625e4a342a132de9021945ad305663e9c0b82016c7193252b0b175b2782d3ec0eb8bc8b8a04621edb1356e1be1f211e778705e773d4b8

Download Submit
\Windows\system\yzfevgq.exe

Filesize
2.2MB

MD5
9a54304d6365a9f813515ef005c417a1

SHA1
e24539d25671b6c13f4f042ce91330cd92df23b1

SHA256
fce3a38cd526a202611c6f7488f512870063608186027b0de2be89e37d7e2ed0

SHA512
7d863bad298221b23e405c59bd1f62afb2ca089a8053d2777a63b1b97707b8a039b232af31c7a39be4bab1b0484628cb3e64bbfb4d2785c97c98bf0d0b4f2369

Download Submit
memory/848-180-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/848-3616-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-1-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2328-237-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2328-241-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2328-203-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2328-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2328-239-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2328-181-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-232-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-213-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-18-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2328-12-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2396-208-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2396-3615-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2440-3627-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-198-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-218-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-3624-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-140-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2500-143-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2500-27-0x00000000027C0000-0x0000000002840000-memory.dmp

Filesize
512KB

Download
memory/2500-242-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download
memory/2500-240-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download
memory/2500-179-0x00000000027C0000-0x0000000002840000-memory.dmp

Filesize
512KB

Download
memory/2500-178-0x000007FEF5720000-0x000007FEF60BD000-memory.dmp

Filesize
9.6MB

Download
memory/2600-3617-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2600-19-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2692-16-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-3631-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-26-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2700-3623-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2988-238-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-3628-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-3613-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-236-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download