xmrig | a93587f591803ea48e186afe57031285182f2fc723d76dcaeaff9fe1a4e8b6a0

Analysis

max time kernel
94s
max time network
97s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
Size

1.9MB
MD5

0bc4de4b0c4daa2826a458e5cf067f4e
SHA1

619e7adb16e3d4331331b361f07ea284b0556131
SHA256

a93587f591803ea48e186afe57031285182f2fc723d76dcaeaff9fe1a4e8b6a0
SHA512

bb7aaaf9cce3def70e025ccbe373c48224862cc8d8008463d8c6a0120348e0a02afa5d9460ec020ae399e451ee14cd0d0d5cc12c4c673e34acff5d06b33b261c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1eL:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/2144-13-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2796-83-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2300-88-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2532-87-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2388-78-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2504-76-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2640-74-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2228-72-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2504-3759-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2640-3779-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2144-3901-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2388-3894-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2228-3998-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2436-4004-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2924-4029-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2144	cPDKVxP.exe
2436	exmtFqi.exe
2532	yppeusG.exe
2924	GNDCJWf.exe
2228	nnWFNuh.exe
2640	qjAafdm.exe
2504	agOkDcK.exe
2388	ZZHWbHN.exe
2796	EboMWuA.exe
1632	tHzUdhf.exe
2848	IlPGaMV.exe
2312	boCcHOy.exe
1636	SzxFmJU.exe
1340	bjzhpkF.exe
1952	hlkXceo.exe
1620	fSFxHuq.exe
2028	ZMCvJsg.exe
1540	BEBKyCQ.exe
2288	XhrguaD.exe
2628	qcCdWIv.exe
1196	AuteJKR.exe
764	xTGJrHe.exe
952	YCuohAv.exe
2296	gknFuxk.exe
2244	wpZXgtK.exe
576	OGMtfAb.exe
2988	rCMJbbE.exe
2744	GiHORnW.exe
1404	PXMtBqj.exe
3020	VZSgiNJ.exe
3004	twrltpG.exe
1788	xrKBMYI.exe
1092	fsMgMoX.exe
984	yszmQSW.exe
2644	vYFmIHv.exe
1828	KziMCNT.exe
2160	UNDwtFe.exe
1832	BQVVGgj.exe
908	gUPlqmV.exe
2284	kcdZOWH.exe
1716	zeyrpiQ.exe
2976	sFUJonl.exe
2708	ImxURhy.exe
2056	JpjXSlF.exe
1660	OUdGQac.exe
2164	PzpEpJA.exe
948	zKDNjKE.exe
1676	XBXntPm.exe
1204	SWkLDLc.exe
2088	FISILgM.exe
2152	lymvVTg.exe
1708	GKxiFUP.exe
876	fNbFNbr.exe
2524	ersUofn.exe
2440	PADeLPr.exe
2468	hWfTUuG.exe
2448	fwgSTrp.exe
2316	fhqResQ.exe
2168	UWVIQsf.exe
1956	SxzmqiJ.exe
2808	DdbPrNI.exe
2572	rrDqHaG.exe
2800	TvqvkES.exe
2016	ZsEuhVG.exe

Loads dropped DLL 64 IoCs

pid	Process
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2300-2-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x000b00000001560a-6.dat	upx
behavioral1/files/0x0029000000015c2f-22.dat	upx
behavioral1/memory/2144-13-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2436-24-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x0008000000015c87-32.dat	upx
behavioral1/files/0x0007000000015cb9-33.dat	upx
behavioral1/files/0x00080000000165ae-39.dat	upx
behavioral1/files/0x0005000000018698-43.dat	upx
behavioral1/files/0x0006000000018ae2-49.dat	upx
behavioral1/files/0x00050000000186a0-47.dat	upx
behavioral1/files/0x0010000000015c3c-57.dat	upx
behavioral1/memory/2796-83-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/files/0x0006000000018b15-95.dat	upx
behavioral1/files/0x0006000000018b6a-120.dat	upx
behavioral1/files/0x0006000000018d06-140.dat	upx
behavioral1/files/0x000500000001931b-152.dat	upx
behavioral1/files/0x0005000000019333-160.dat	upx
behavioral1/files/0x00050000000193b0-181.dat	upx
behavioral1/files/0x000500000001946b-190.dat	upx
behavioral1/files/0x0005000000019410-185.dat	upx
behavioral1/files/0x0005000000019377-170.dat	upx
behavioral1/files/0x000500000001939b-174.dat	upx
behavioral1/files/0x00050000000192f4-150.dat	upx
behavioral1/files/0x0005000000019368-165.dat	upx
behavioral1/files/0x00050000000192c9-144.dat	upx
behavioral1/files/0x0006000000018b96-131.dat	upx
behavioral1/files/0x0006000000018b42-119.dat	upx
behavioral1/files/0x0006000000018ba2-134.dat	upx
behavioral1/files/0x0006000000018b73-123.dat	upx
behavioral1/files/0x0006000000018b33-98.dat	upx
behavioral1/files/0x0006000000018b4a-111.dat	upx
behavioral1/files/0x0006000000018b37-103.dat	upx
behavioral1/files/0x0006000000018ae8-90.dat	upx
behavioral1/memory/2532-87-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2388-78-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2504-76-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2640-74-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2228-72-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2924-68-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-28.dat	upx
behavioral1/files/0x0009000000015c69-20.dat	upx
behavioral1/memory/2504-3759-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2640-3779-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2144-3901-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2388-3894-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2228-3998-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2436-4004-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2924-4029-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JfsSsFT.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\iQClHIk.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\XxNgSho.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\SisFGyy.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\dWAqKzi.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\wjJtKma.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\JyXJcbN.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\yzthSjH.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\ULDDSie.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\BZZiCbf.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\MuXgAdC.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\cIMSLvE.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\yTvxgnk.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\oghVLUa.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\HGufNoG.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\NrkykYy.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\SZXPosc.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\IWfybQd.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\PLsjBgp.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\xjhYzqX.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\FxGnIFF.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\EsKQqQn.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\dfkXYEK.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\xehgbuC.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\cEHIoNG.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\pVaUHqe.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\wpZXgtK.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\vUPMshZ.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\zNfwRbT.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\kzDLsmb.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\WMQGdND.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\uruuQoC.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\jizVGFE.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\DPwGahG.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\IuNWSyR.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\PezmOjP.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\GHPKHMv.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\iiBtMam.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\YKlYYyF.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\wcfaOBD.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\LuOMOXt.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\flTVGal.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\tiHCmhg.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\wXjpZqy.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\ZprYkbU.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\dZTAuaB.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\QqlSeEp.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\QdmlGPv.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\paeaWKD.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\gOYUXIv.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\knrkeoi.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\gcIRlGQ.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\ZZHWbHN.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\OGMtfAb.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\GikLhbT.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\fOumhzj.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\QBRzjGO.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\JDWMzLl.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\PXMtBqj.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\yfMbyyk.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\wEcwZGB.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\tjWZAeJ.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\MZnKlgS.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\tclMfZs.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1776	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
Token: SeDebugPrivilege	1776	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1776	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	29
PID 2300 wrote to memory of 1776	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	29
PID 2300 wrote to memory of 1776	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	29
PID 2300 wrote to memory of 2144	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2144	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2144	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2532	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	31
PID 2300 wrote to memory of 2532	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	31
PID 2300 wrote to memory of 2532	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	31
PID 2300 wrote to memory of 2436	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	32
PID 2300 wrote to memory of 2436	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	32
PID 2300 wrote to memory of 2436	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	32
PID 2300 wrote to memory of 2924	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	33
PID 2300 wrote to memory of 2924	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	33
PID 2300 wrote to memory of 2924	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	33
PID 2300 wrote to memory of 2228	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	34
PID 2300 wrote to memory of 2228	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	34
PID 2300 wrote to memory of 2228	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	34
PID 2300 wrote to memory of 2640	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	35
PID 2300 wrote to memory of 2640	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	35
PID 2300 wrote to memory of 2640	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	35
PID 2300 wrote to memory of 2504	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	36
PID 2300 wrote to memory of 2504	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	36
PID 2300 wrote to memory of 2504	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	36
PID 2300 wrote to memory of 2388	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	37
PID 2300 wrote to memory of 2388	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	37
PID 2300 wrote to memory of 2388	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	37
PID 2300 wrote to memory of 2796	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	38
PID 2300 wrote to memory of 2796	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	38
PID 2300 wrote to memory of 2796	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	38
PID 2300 wrote to memory of 2848	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	39
PID 2300 wrote to memory of 2848	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	39
PID 2300 wrote to memory of 2848	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	39
PID 2300 wrote to memory of 1632	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	40
PID 2300 wrote to memory of 1632	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	40
PID 2300 wrote to memory of 1632	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	40
PID 2300 wrote to memory of 2312	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	41
PID 2300 wrote to memory of 2312	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	41
PID 2300 wrote to memory of 2312	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	41
PID 2300 wrote to memory of 1636	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	42
PID 2300 wrote to memory of 1636	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	42
PID 2300 wrote to memory of 1636	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	42
PID 2300 wrote to memory of 1620	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	43
PID 2300 wrote to memory of 1620	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	43
PID 2300 wrote to memory of 1620	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	43
PID 2300 wrote to memory of 1340	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	44
PID 2300 wrote to memory of 1340	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	44
PID 2300 wrote to memory of 1340	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	44
PID 2300 wrote to memory of 2028	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	45
PID 2300 wrote to memory of 2028	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	45
PID 2300 wrote to memory of 2028	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	45
PID 2300 wrote to memory of 1952	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	46
PID 2300 wrote to memory of 1952	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	46
PID 2300 wrote to memory of 1952	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	46
PID 2300 wrote to memory of 1540	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	47
PID 2300 wrote to memory of 1540	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	47
PID 2300 wrote to memory of 1540	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	47
PID 2300 wrote to memory of 2288	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	48
PID 2300 wrote to memory of 2288	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	48
PID 2300 wrote to memory of 2288	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	48
PID 2300 wrote to memory of 2628	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	49
PID 2300 wrote to memory of 2628	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	49
PID 2300 wrote to memory of 2628	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	49
PID 2300 wrote to memory of 1196	2300	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\System\cPDKVxP.exe
  C:\Windows\System\cPDKVxP.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\yppeusG.exe
  C:\Windows\System\yppeusG.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\exmtFqi.exe
  C:\Windows\System\exmtFqi.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\GNDCJWf.exe
  C:\Windows\System\GNDCJWf.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\nnWFNuh.exe
  C:\Windows\System\nnWFNuh.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\qjAafdm.exe
  C:\Windows\System\qjAafdm.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\agOkDcK.exe
  C:\Windows\System\agOkDcK.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\ZZHWbHN.exe
  C:\Windows\System\ZZHWbHN.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\EboMWuA.exe
  C:\Windows\System\EboMWuA.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\IlPGaMV.exe
  C:\Windows\System\IlPGaMV.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\tHzUdhf.exe
  C:\Windows\System\tHzUdhf.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\boCcHOy.exe
  C:\Windows\System\boCcHOy.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\SzxFmJU.exe
  C:\Windows\System\SzxFmJU.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\fSFxHuq.exe
  C:\Windows\System\fSFxHuq.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\bjzhpkF.exe
  C:\Windows\System\bjzhpkF.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\ZMCvJsg.exe
  C:\Windows\System\ZMCvJsg.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\hlkXceo.exe
  C:\Windows\System\hlkXceo.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\BEBKyCQ.exe
  C:\Windows\System\BEBKyCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\XhrguaD.exe
  C:\Windows\System\XhrguaD.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\qcCdWIv.exe
  C:\Windows\System\qcCdWIv.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\AuteJKR.exe
  C:\Windows\System\AuteJKR.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\xTGJrHe.exe
  C:\Windows\System\xTGJrHe.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\YCuohAv.exe
  C:\Windows\System\YCuohAv.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\gknFuxk.exe
  C:\Windows\System\gknFuxk.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\wpZXgtK.exe
  C:\Windows\System\wpZXgtK.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\OGMtfAb.exe
  C:\Windows\System\OGMtfAb.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\rCMJbbE.exe
  C:\Windows\System\rCMJbbE.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\GiHORnW.exe
  C:\Windows\System\GiHORnW.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\PXMtBqj.exe
  C:\Windows\System\PXMtBqj.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\VZSgiNJ.exe
  C:\Windows\System\VZSgiNJ.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\twrltpG.exe
  C:\Windows\System\twrltpG.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\xrKBMYI.exe
  C:\Windows\System\xrKBMYI.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\fsMgMoX.exe
  C:\Windows\System\fsMgMoX.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\yszmQSW.exe
  C:\Windows\System\yszmQSW.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\vYFmIHv.exe
  C:\Windows\System\vYFmIHv.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\KziMCNT.exe
  C:\Windows\System\KziMCNT.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\UNDwtFe.exe
  C:\Windows\System\UNDwtFe.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\BQVVGgj.exe
  C:\Windows\System\BQVVGgj.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\gUPlqmV.exe
  C:\Windows\System\gUPlqmV.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\kcdZOWH.exe
  C:\Windows\System\kcdZOWH.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\zeyrpiQ.exe
  C:\Windows\System\zeyrpiQ.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\sFUJonl.exe
  C:\Windows\System\sFUJonl.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\ImxURhy.exe
  C:\Windows\System\ImxURhy.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\JpjXSlF.exe
  C:\Windows\System\JpjXSlF.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\OUdGQac.exe
  C:\Windows\System\OUdGQac.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\PzpEpJA.exe
  C:\Windows\System\PzpEpJA.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\zKDNjKE.exe
  C:\Windows\System\zKDNjKE.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\XBXntPm.exe
  C:\Windows\System\XBXntPm.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\SWkLDLc.exe
  C:\Windows\System\SWkLDLc.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\FISILgM.exe
  C:\Windows\System\FISILgM.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\lymvVTg.exe
  C:\Windows\System\lymvVTg.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\GKxiFUP.exe
  C:\Windows\System\GKxiFUP.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\fNbFNbr.exe
  C:\Windows\System\fNbFNbr.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\PADeLPr.exe
  C:\Windows\System\PADeLPr.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ersUofn.exe
  C:\Windows\System\ersUofn.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\fwgSTrp.exe
  C:\Windows\System\fwgSTrp.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\hWfTUuG.exe
  C:\Windows\System\hWfTUuG.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\UWVIQsf.exe
  C:\Windows\System\UWVIQsf.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\fhqResQ.exe
  C:\Windows\System\fhqResQ.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\SxzmqiJ.exe
  C:\Windows\System\SxzmqiJ.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\DdbPrNI.exe
  C:\Windows\System\DdbPrNI.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\rrDqHaG.exe
  C:\Windows\System\rrDqHaG.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\TvqvkES.exe
  C:\Windows\System\TvqvkES.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ZsEuhVG.exe
  C:\Windows\System\ZsEuhVG.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\QnYvRbc.exe
  C:\Windows\System\QnYvRbc.exe
  2⤵
  PID:1920
- C:\Windows\System\nGhjlnj.exe
  C:\Windows\System\nGhjlnj.exe
  2⤵
  PID:1732
- C:\Windows\System\yfMbyyk.exe
  C:\Windows\System\yfMbyyk.exe
  2⤵
  PID:1644
- C:\Windows\System\BdhrOfT.exe
  C:\Windows\System\BdhrOfT.exe
  2⤵
  PID:2252
- C:\Windows\System\dtuZvJa.exe
  C:\Windows\System\dtuZvJa.exe
  2⤵
  PID:2584
- C:\Windows\System\HfuRYKB.exe
  C:\Windows\System\HfuRYKB.exe
  2⤵
  PID:2308
- C:\Windows\System\TMCmfme.exe
  C:\Windows\System\TMCmfme.exe
  2⤵
  PID:584
- C:\Windows\System\jdobpJT.exe
  C:\Windows\System\jdobpJT.exe
  2⤵
  PID:592
- C:\Windows\System\lHEAMUw.exe
  C:\Windows\System\lHEAMUw.exe
  2⤵
  PID:580
- C:\Windows\System\wOOdyFS.exe
  C:\Windows\System\wOOdyFS.exe
  2⤵
  PID:1728
- C:\Windows\System\RQSogWJ.exe
  C:\Windows\System\RQSogWJ.exe
  2⤵
  PID:3008
- C:\Windows\System\cSdroCn.exe
  C:\Windows\System\cSdroCn.exe
  2⤵
  PID:1544
- C:\Windows\System\AghPJot.exe
  C:\Windows\System\AghPJot.exe
  2⤵
  PID:628
- C:\Windows\System\HUBKyOn.exe
  C:\Windows\System\HUBKyOn.exe
  2⤵
  PID:1548
- C:\Windows\System\SMMEiBC.exe
  C:\Windows\System\SMMEiBC.exe
  2⤵
  PID:2040
- C:\Windows\System\USJRziZ.exe
  C:\Windows\System\USJRziZ.exe
  2⤵
  PID:1068
- C:\Windows\System\wExuDdi.exe
  C:\Windows\System\wExuDdi.exe
  2⤵
  PID:2840
- C:\Windows\System\yGSslCr.exe
  C:\Windows\System\yGSslCr.exe
  2⤵
  PID:2748
- C:\Windows\System\gBotAkc.exe
  C:\Windows\System\gBotAkc.exe
  2⤵
  PID:2944
- C:\Windows\System\qEDqEfW.exe
  C:\Windows\System\qEDqEfW.exe
  2⤵
  PID:2108
- C:\Windows\System\BZZiCbf.exe
  C:\Windows\System\BZZiCbf.exe
  2⤵
  PID:804
- C:\Windows\System\thszPVC.exe
  C:\Windows\System\thszPVC.exe
  2⤵
  PID:1556
- C:\Windows\System\IWfybQd.exe
  C:\Windows\System\IWfybQd.exe
  2⤵
  PID:2208
- C:\Windows\System\RVdbnTf.exe
  C:\Windows\System\RVdbnTf.exe
  2⤵
  PID:1588
- C:\Windows\System\UwPLzlN.exe
  C:\Windows\System\UwPLzlN.exe
  2⤵
  PID:1936
- C:\Windows\System\PFdfDiK.exe
  C:\Windows\System\PFdfDiK.exe
  2⤵
  PID:2916
- C:\Windows\System\XxVLOIl.exe
  C:\Windows\System\XxVLOIl.exe
  2⤵
  PID:2864
- C:\Windows\System\KLDEmeN.exe
  C:\Windows\System\KLDEmeN.exe
  2⤵
  PID:1596
- C:\Windows\System\cZIfdlO.exe
  C:\Windows\System\cZIfdlO.exe
  2⤵
  PID:2568
- C:\Windows\System\eerNivI.exe
  C:\Windows\System\eerNivI.exe
  2⤵
  PID:2036
- C:\Windows\System\nrcOiip.exe
  C:\Windows\System\nrcOiip.exe
  2⤵
  PID:2672
- C:\Windows\System\DxKWZgt.exe
  C:\Windows\System\DxKWZgt.exe
  2⤵
  PID:2328
- C:\Windows\System\wEcwZGB.exe
  C:\Windows\System\wEcwZGB.exe
  2⤵
  PID:2608
- C:\Windows\System\IInUZjh.exe
  C:\Windows\System\IInUZjh.exe
  2⤵
  PID:1988
- C:\Windows\System\geTVCIV.exe
  C:\Windows\System\geTVCIV.exe
  2⤵
  PID:2004
- C:\Windows\System\xRPTNxT.exe
  C:\Windows\System\xRPTNxT.exe
  2⤵
  PID:1720
- C:\Windows\System\dNVSLXu.exe
  C:\Windows\System\dNVSLXu.exe
  2⤵
  PID:2280
- C:\Windows\System\XjOnBVW.exe
  C:\Windows\System\XjOnBVW.exe
  2⤵
  PID:2960
- C:\Windows\System\vtDUKGP.exe
  C:\Windows\System\vtDUKGP.exe
  2⤵
  PID:768
- C:\Windows\System\SFpzNZt.exe
  C:\Windows\System\SFpzNZt.exe
  2⤵
  PID:1536
- C:\Windows\System\KGLYjeK.exe
  C:\Windows\System\KGLYjeK.exe
  2⤵
  PID:436
- C:\Windows\System\HkYfPvV.exe
  C:\Windows\System\HkYfPvV.exe
  2⤵
  PID:1152
- C:\Windows\System\HhxCctY.exe
  C:\Windows\System\HhxCctY.exe
  2⤵
  PID:1796
- C:\Windows\System\kEmHLvI.exe
  C:\Windows\System\kEmHLvI.exe
  2⤵
  PID:888
- C:\Windows\System\QRREiWH.exe
  C:\Windows\System\QRREiWH.exe
  2⤵
  PID:880
- C:\Windows\System\KitizMD.exe
  C:\Windows\System\KitizMD.exe
  2⤵
  PID:2536
- C:\Windows\System\WiuXeqO.exe
  C:\Windows\System\WiuXeqO.exe
  2⤵
  PID:1384
- C:\Windows\System\plMToUh.exe
  C:\Windows\System\plMToUh.exe
  2⤵
  PID:1308
- C:\Windows\System\OsceIZW.exe
  C:\Windows\System\OsceIZW.exe
  2⤵
  PID:1992
- C:\Windows\System\jWLzcgw.exe
  C:\Windows\System\jWLzcgw.exe
  2⤵
  PID:2012
- C:\Windows\System\wXjpZqy.exe
  C:\Windows\System\wXjpZqy.exe
  2⤵
  PID:2188
- C:\Windows\System\yVBeRoy.exe
  C:\Windows\System\yVBeRoy.exe
  2⤵
  PID:1968
- C:\Windows\System\nBpcfjk.exe
  C:\Windows\System\nBpcfjk.exe
  2⤵
  PID:2224
- C:\Windows\System\MuXgAdC.exe
  C:\Windows\System\MuXgAdC.exe
  2⤵
  PID:1904
- C:\Windows\System\VzWbhej.exe
  C:\Windows\System\VzWbhej.exe
  2⤵
  PID:1608
- C:\Windows\System\JSBdPGR.exe
  C:\Windows\System\JSBdPGR.exe
  2⤵
  PID:2612
- C:\Windows\System\QStMeIL.exe
  C:\Windows\System\QStMeIL.exe
  2⤵
  PID:2476
- C:\Windows\System\rbLNRhV.exe
  C:\Windows\System\rbLNRhV.exe
  2⤵
  PID:1332
- C:\Windows\System\zeVeeBI.exe
  C:\Windows\System\zeVeeBI.exe
  2⤵
  PID:2680
- C:\Windows\System\RskmDCa.exe
  C:\Windows\System\RskmDCa.exe
  2⤵
  PID:2428
- C:\Windows\System\JfsSsFT.exe
  C:\Windows\System\JfsSsFT.exe
  2⤵
  PID:1996
- C:\Windows\System\WWtICaO.exe
  C:\Windows\System\WWtICaO.exe
  2⤵
  PID:1388
- C:\Windows\System\xlFIeNI.exe
  C:\Windows\System\xlFIeNI.exe
  2⤵
  PID:2636
- C:\Windows\System\XEmevYS.exe
  C:\Windows\System\XEmevYS.exe
  2⤵
  PID:2556
- C:\Windows\System\pebjvJd.exe
  C:\Windows\System\pebjvJd.exe
  2⤵
  PID:2940
- C:\Windows\System\TnIBsFb.exe
  C:\Windows\System\TnIBsFb.exe
  2⤵
  PID:416
- C:\Windows\System\AAWuGNn.exe
  C:\Windows\System\AAWuGNn.exe
  2⤵
  PID:2580
- C:\Windows\System\kDlGSzP.exe
  C:\Windows\System\kDlGSzP.exe
  2⤵
  PID:2724
- C:\Windows\System\WMGDdWe.exe
  C:\Windows\System\WMGDdWe.exe
  2⤵
  PID:524
- C:\Windows\System\tBBzYfT.exe
  C:\Windows\System\tBBzYfT.exe
  2⤵
  PID:3016
- C:\Windows\System\MurPjVS.exe
  C:\Windows\System\MurPjVS.exe
  2⤵
  PID:2412
- C:\Windows\System\qaIGDya.exe
  C:\Windows\System\qaIGDya.exe
  2⤵
  PID:1112
- C:\Windows\System\WEWXFqV.exe
  C:\Windows\System\WEWXFqV.exe
  2⤵
  PID:1048
- C:\Windows\System\yngFulB.exe
  C:\Windows\System\yngFulB.exe
  2⤵
  PID:112
- C:\Windows\System\vRYNHyi.exe
  C:\Windows\System\vRYNHyi.exe
  2⤵
  PID:2132
- C:\Windows\System\lTqcnnL.exe
  C:\Windows\System\lTqcnnL.exe
  2⤵
  PID:1624
- C:\Windows\System\XBtBdlR.exe
  C:\Windows\System\XBtBdlR.exe
  2⤵
  PID:2664
- C:\Windows\System\kYaaTqc.exe
  C:\Windows\System\kYaaTqc.exe
  2⤵
  PID:2200
- C:\Windows\System\dXeeWxj.exe
  C:\Windows\System\dXeeWxj.exe
  2⤵
  PID:2248
- C:\Windows\System\epQLtWv.exe
  C:\Windows\System\epQLtWv.exe
  2⤵
  PID:1088
- C:\Windows\System\YNtZFAU.exe
  C:\Windows\System\YNtZFAU.exe
  2⤵
  PID:2432
- C:\Windows\System\dISEMHw.exe
  C:\Windows\System\dISEMHw.exe
  2⤵
  PID:2264
- C:\Windows\System\gOYUXIv.exe
  C:\Windows\System\gOYUXIv.exe
  2⤵
  PID:1192
- C:\Windows\System\OyReCno.exe
  C:\Windows\System\OyReCno.exe
  2⤵
  PID:2024
- C:\Windows\System\ErhQjbH.exe
  C:\Windows\System\ErhQjbH.exe
  2⤵
  PID:2372
- C:\Windows\System\SmIEWLZ.exe
  C:\Windows\System\SmIEWLZ.exe
  2⤵
  PID:1892
- C:\Windows\System\VvWDjYn.exe
  C:\Windows\System\VvWDjYn.exe
  2⤵
  PID:2096
- C:\Windows\System\IaSDCbD.exe
  C:\Windows\System\IaSDCbD.exe
  2⤵
  PID:1116
- C:\Windows\System\ZJamEtT.exe
  C:\Windows\System\ZJamEtT.exe
  2⤵
  PID:2268
- C:\Windows\System\hoZKkKs.exe
  C:\Windows\System\hoZKkKs.exe
  2⤵
  PID:1668
- C:\Windows\System\eZFOikc.exe
  C:\Windows\System\eZFOikc.exe
  2⤵
  PID:2084
- C:\Windows\System\zzFqjgn.exe
  C:\Windows\System\zzFqjgn.exe
  2⤵
  PID:1104
- C:\Windows\System\fzJLVuz.exe
  C:\Windows\System\fzJLVuz.exe
  2⤵
  PID:2356
- C:\Windows\System\TOhNjdr.exe
  C:\Windows\System\TOhNjdr.exe
  2⤵
  PID:1656
- C:\Windows\System\JVyTqgz.exe
  C:\Windows\System\JVyTqgz.exe
  2⤵
  PID:2064
- C:\Windows\System\srtJTmX.exe
  C:\Windows\System\srtJTmX.exe
  2⤵
  PID:884
- C:\Windows\System\ZhFEUIm.exe
  C:\Windows\System\ZhFEUIm.exe
  2⤵
  PID:2872
- C:\Windows\System\pxtfiet.exe
  C:\Windows\System\pxtfiet.exe
  2⤵
  PID:3092
- C:\Windows\System\UvsMVoq.exe
  C:\Windows\System\UvsMVoq.exe
  2⤵
  PID:3116
- C:\Windows\System\ReuWSiv.exe
  C:\Windows\System\ReuWSiv.exe
  2⤵
  PID:3132
- C:\Windows\System\BJaWyrs.exe
  C:\Windows\System\BJaWyrs.exe
  2⤵
  PID:3160
- C:\Windows\System\hQIlBeY.exe
  C:\Windows\System\hQIlBeY.exe
  2⤵
  PID:3176
- C:\Windows\System\iUpjdil.exe
  C:\Windows\System\iUpjdil.exe
  2⤵
  PID:3192
- C:\Windows\System\LFxOmTx.exe
  C:\Windows\System\LFxOmTx.exe
  2⤵
  PID:3212
- C:\Windows\System\pJVZXGg.exe
  C:\Windows\System\pJVZXGg.exe
  2⤵
  PID:3228
- C:\Windows\System\wLJiIOb.exe
  C:\Windows\System\wLJiIOb.exe
  2⤵
  PID:3244
- C:\Windows\System\hMeWLYL.exe
  C:\Windows\System\hMeWLYL.exe
  2⤵
  PID:3260
- C:\Windows\System\rGEnOOC.exe
  C:\Windows\System\rGEnOOC.exe
  2⤵
  PID:3276
- C:\Windows\System\ReoioMf.exe
  C:\Windows\System\ReoioMf.exe
  2⤵
  PID:3292
- C:\Windows\System\GAnUvmF.exe
  C:\Windows\System\GAnUvmF.exe
  2⤵
  PID:3328
- C:\Windows\System\dwXhLuP.exe
  C:\Windows\System\dwXhLuP.exe
  2⤵
  PID:3352
- C:\Windows\System\LZpwPzG.exe
  C:\Windows\System\LZpwPzG.exe
  2⤵
  PID:3368
- C:\Windows\System\WIWIDsA.exe
  C:\Windows\System\WIWIDsA.exe
  2⤵
  PID:3384
- C:\Windows\System\Qoefdvm.exe
  C:\Windows\System\Qoefdvm.exe
  2⤵
  PID:3400
- C:\Windows\System\dPjoufm.exe
  C:\Windows\System\dPjoufm.exe
  2⤵
  PID:3416
- C:\Windows\System\qrGyzsk.exe
  C:\Windows\System\qrGyzsk.exe
  2⤵
  PID:3432
- C:\Windows\System\RqGVxeL.exe
  C:\Windows\System\RqGVxeL.exe
  2⤵
  PID:3448
- C:\Windows\System\hViYpvm.exe
  C:\Windows\System\hViYpvm.exe
  2⤵
  PID:3468
- C:\Windows\System\pdiBBMT.exe
  C:\Windows\System\pdiBBMT.exe
  2⤵
  PID:3484
- C:\Windows\System\yTqBwfG.exe
  C:\Windows\System\yTqBwfG.exe
  2⤵
  PID:3508
- C:\Windows\System\EMphvCT.exe
  C:\Windows\System\EMphvCT.exe
  2⤵
  PID:3524
- C:\Windows\System\ZIZuKQF.exe
  C:\Windows\System\ZIZuKQF.exe
  2⤵
  PID:3540
- C:\Windows\System\tcbIvLp.exe
  C:\Windows\System\tcbIvLp.exe
  2⤵
  PID:3556
- C:\Windows\System\BVTBaLi.exe
  C:\Windows\System\BVTBaLi.exe
  2⤵
  PID:3572
- C:\Windows\System\qFgiurt.exe
  C:\Windows\System\qFgiurt.exe
  2⤵
  PID:3592
- C:\Windows\System\hTQiLjz.exe
  C:\Windows\System\hTQiLjz.exe
  2⤵
  PID:3608
- C:\Windows\System\EeTZPzu.exe
  C:\Windows\System\EeTZPzu.exe
  2⤵
  PID:3624
- C:\Windows\System\qFaXJSj.exe
  C:\Windows\System\qFaXJSj.exe
  2⤵
  PID:3640
- C:\Windows\System\KeTfkTm.exe
  C:\Windows\System\KeTfkTm.exe
  2⤵
  PID:3656
- C:\Windows\System\BAzAQyo.exe
  C:\Windows\System\BAzAQyo.exe
  2⤵
  PID:3672
- C:\Windows\System\JynLsRA.exe
  C:\Windows\System\JynLsRA.exe
  2⤵
  PID:3688
- C:\Windows\System\IrzwoUO.exe
  C:\Windows\System\IrzwoUO.exe
  2⤵
  PID:3704
- C:\Windows\System\iiBtMam.exe
  C:\Windows\System\iiBtMam.exe
  2⤵
  PID:3724
- C:\Windows\System\PFKkqIR.exe
  C:\Windows\System\PFKkqIR.exe
  2⤵
  PID:3740
- C:\Windows\System\NuGPxfy.exe
  C:\Windows\System\NuGPxfy.exe
  2⤵
  PID:3760
- C:\Windows\System\lmsNGdL.exe
  C:\Windows\System\lmsNGdL.exe
  2⤵
  PID:3776
- C:\Windows\System\jgNCwAN.exe
  C:\Windows\System\jgNCwAN.exe
  2⤵
  PID:3792
- C:\Windows\System\fIivyaK.exe
  C:\Windows\System\fIivyaK.exe
  2⤵
  PID:3808
- C:\Windows\System\AzafmDo.exe
  C:\Windows\System\AzafmDo.exe
  2⤵
  PID:3824
- C:\Windows\System\WlUJODX.exe
  C:\Windows\System\WlUJODX.exe
  2⤵
  PID:3840
- C:\Windows\System\yOgsKJN.exe
  C:\Windows\System\yOgsKJN.exe
  2⤵
  PID:3864
- C:\Windows\System\euJtjnA.exe
  C:\Windows\System\euJtjnA.exe
  2⤵
  PID:3884
- C:\Windows\System\dQlohGg.exe
  C:\Windows\System\dQlohGg.exe
  2⤵
  PID:3900
- C:\Windows\System\bfrucIy.exe
  C:\Windows\System\bfrucIy.exe
  2⤵
  PID:3916
- C:\Windows\System\QICbeHK.exe
  C:\Windows\System\QICbeHK.exe
  2⤵
  PID:3932
- C:\Windows\System\vGtIUPi.exe
  C:\Windows\System\vGtIUPi.exe
  2⤵
  PID:3948
- C:\Windows\System\GTBvDKv.exe
  C:\Windows\System\GTBvDKv.exe
  2⤵
  PID:3964
- C:\Windows\System\bzFBRfa.exe
  C:\Windows\System\bzFBRfa.exe
  2⤵
  PID:3980
- C:\Windows\System\mxwnuVw.exe
  C:\Windows\System\mxwnuVw.exe
  2⤵
  PID:3996
- C:\Windows\System\IRxIABA.exe
  C:\Windows\System\IRxIABA.exe
  2⤵
  PID:4012
- C:\Windows\System\TqWPOxo.exe
  C:\Windows\System\TqWPOxo.exe
  2⤵
  PID:4028
- C:\Windows\System\yQbcxCu.exe
  C:\Windows\System\yQbcxCu.exe
  2⤵
  PID:4052
- C:\Windows\System\vUPMshZ.exe
  C:\Windows\System\vUPMshZ.exe
  2⤵
  PID:4068
- C:\Windows\System\zoBuKMe.exe
  C:\Windows\System\zoBuKMe.exe
  2⤵
  PID:2072
- C:\Windows\System\okRLXys.exe
  C:\Windows\System\okRLXys.exe
  2⤵
  PID:2192
- C:\Windows\System\JFdzeXV.exe
  C:\Windows\System\JFdzeXV.exe
  2⤵
  PID:3080
- C:\Windows\System\JtxDZsV.exe
  C:\Windows\System\JtxDZsV.exe
  2⤵
  PID:1576
- C:\Windows\System\JcJMcsB.exe
  C:\Windows\System\JcJMcsB.exe
  2⤵
  PID:3124
- C:\Windows\System\kArvIll.exe
  C:\Windows\System\kArvIll.exe
  2⤵
  PID:840
- C:\Windows\System\zNfwRbT.exe
  C:\Windows\System\zNfwRbT.exe
  2⤵
  PID:3104
- C:\Windows\System\qxwTDau.exe
  C:\Windows\System\qxwTDau.exe
  2⤵
  PID:3144
- C:\Windows\System\IKQasQj.exe
  C:\Windows\System\IKQasQj.exe
  2⤵
  PID:3200
- C:\Windows\System\eRappxo.exe
  C:\Windows\System\eRappxo.exe
  2⤵
  PID:3300
- C:\Windows\System\hlHQZHu.exe
  C:\Windows\System\hlHQZHu.exe
  2⤵
  PID:3316
- C:\Windows\System\gijrtpM.exe
  C:\Windows\System\gijrtpM.exe
  2⤵
  PID:3156
- C:\Windows\System\YLnBBHa.exe
  C:\Windows\System\YLnBBHa.exe
  2⤵
  PID:2528
- C:\Windows\System\KJZZyzu.exe
  C:\Windows\System\KJZZyzu.exe
  2⤵
  PID:3392
- C:\Windows\System\ziBiHrf.exe
  C:\Windows\System\ziBiHrf.exe
  2⤵
  PID:3460
- C:\Windows\System\hGxRJjq.exe
  C:\Windows\System\hGxRJjq.exe
  2⤵
  PID:3256
- C:\Windows\System\ErsSVbO.exe
  C:\Windows\System\ErsSVbO.exe
  2⤵
  PID:3496
- C:\Windows\System\VQCTLQQ.exe
  C:\Windows\System\VQCTLQQ.exe
  2⤵
  PID:3336
- C:\Windows\System\XlDVrcU.exe
  C:\Windows\System\XlDVrcU.exe
  2⤵
  PID:3444
- C:\Windows\System\dTniyks.exe
  C:\Windows\System\dTniyks.exe
  2⤵
  PID:3408
- C:\Windows\System\OnvFmgU.exe
  C:\Windows\System\OnvFmgU.exe
  2⤵
  PID:3548
- C:\Windows\System\BkZqfTv.exe
  C:\Windows\System\BkZqfTv.exe
  2⤵
  PID:3536
- C:\Windows\System\qKuCKUM.exe
  C:\Windows\System\qKuCKUM.exe
  2⤵
  PID:3588
- C:\Windows\System\DHiupbe.exe
  C:\Windows\System\DHiupbe.exe
  2⤵
  PID:3652
- C:\Windows\System\rKqwssl.exe
  C:\Windows\System\rKqwssl.exe
  2⤵
  PID:1372
- C:\Windows\System\FgYNYaD.exe
  C:\Windows\System\FgYNYaD.exe
  2⤵
  PID:3700
- C:\Windows\System\YCttcMS.exe
  C:\Windows\System\YCttcMS.exe
  2⤵
  PID:3800
- C:\Windows\System\XKjarXr.exe
  C:\Windows\System\XKjarXr.exe
  2⤵
  PID:3752
- C:\Windows\System\HzKvEVx.exe
  C:\Windows\System\HzKvEVx.exe
  2⤵
  PID:3716
- C:\Windows\System\ZqPnHub.exe
  C:\Windows\System\ZqPnHub.exe
  2⤵
  PID:3852
- C:\Windows\System\lJrPtrB.exe
  C:\Windows\System\lJrPtrB.exe
  2⤵
  PID:4020
- C:\Windows\System\cVfInMD.exe
  C:\Windows\System\cVfInMD.exe
  2⤵
  PID:3896
- C:\Windows\System\iyXIceX.exe
  C:\Windows\System\iyXIceX.exe
  2⤵
  PID:3912
- C:\Windows\System\iJBvwdB.exe
  C:\Windows\System\iJBvwdB.exe
  2⤵
  PID:3976
- C:\Windows\System\hELcFTp.exe
  C:\Windows\System\hELcFTp.exe
  2⤵
  PID:4044
- C:\Windows\System\VrjjVXQ.exe
  C:\Windows\System\VrjjVXQ.exe
  2⤵
  PID:4088
- C:\Windows\System\ReZCSnz.exe
  C:\Windows\System\ReZCSnz.exe
  2⤵
  PID:1236
- C:\Windows\System\TUCIbEc.exe
  C:\Windows\System\TUCIbEc.exe
  2⤵
  PID:1460
- C:\Windows\System\RlvZHlm.exe
  C:\Windows\System\RlvZHlm.exe
  2⤵
  PID:3992
- C:\Windows\System\MllBQBH.exe
  C:\Windows\System\MllBQBH.exe
  2⤵
  PID:2784
- C:\Windows\System\axBFUIS.exe
  C:\Windows\System\axBFUIS.exe
  2⤵
  PID:4064
- C:\Windows\System\hMQgikP.exe
  C:\Windows\System\hMQgikP.exe
  2⤵
  PID:2148
- C:\Windows\System\cxyextt.exe
  C:\Windows\System\cxyextt.exe
  2⤵
  PID:3084
- C:\Windows\System\glsNgDx.exe
  C:\Windows\System\glsNgDx.exe
  2⤵
  PID:1912
- C:\Windows\System\yrQgqqX.exe
  C:\Windows\System\yrQgqqX.exe
  2⤵
  PID:2424
- C:\Windows\System\vMKreFd.exe
  C:\Windows\System\vMKreFd.exe
  2⤵
  PID:3464
- C:\Windows\System\yLsyNip.exe
  C:\Windows\System\yLsyNip.exe
  2⤵
  PID:3348
- C:\Windows\System\GuOvSKN.exe
  C:\Windows\System\GuOvSKN.exe
  2⤵
  PID:3476
- C:\Windows\System\aqAanWM.exe
  C:\Windows\System\aqAanWM.exe
  2⤵
  PID:3440
- C:\Windows\System\cIMSLvE.exe
  C:\Windows\System\cIMSLvE.exe
  2⤵
  PID:2696
- C:\Windows\System\hmISXgX.exe
  C:\Windows\System\hmISXgX.exe
  2⤵
  PID:3396
- C:\Windows\System\bgadTOk.exe
  C:\Windows\System\bgadTOk.exe
  2⤵
  PID:3380
- C:\Windows\System\gaRXFrI.exe
  C:\Windows\System\gaRXFrI.exe
  2⤵
  PID:2828
- C:\Windows\System\KbTkSKJ.exe
  C:\Windows\System\KbTkSKJ.exe
  2⤵
  PID:3620
- C:\Windows\System\mNVzUQE.exe
  C:\Windows\System\mNVzUQE.exe
  2⤵
  PID:3768
- C:\Windows\System\lFYIBiH.exe
  C:\Windows\System\lFYIBiH.exe
  2⤵
  PID:3680
- C:\Windows\System\wosKclS.exe
  C:\Windows\System\wosKclS.exe
  2⤵
  PID:3880
- C:\Windows\System\UAUormF.exe
  C:\Windows\System\UAUormF.exe
  2⤵
  PID:4036
- C:\Windows\System\ZprYkbU.exe
  C:\Windows\System\ZprYkbU.exe
  2⤵
  PID:3960
- C:\Windows\System\nEDjxUn.exe
  C:\Windows\System\nEDjxUn.exe
  2⤵
  PID:652
- C:\Windows\System\GikLhbT.exe
  C:\Windows\System\GikLhbT.exe
  2⤵
  PID:2824
- C:\Windows\System\dkEavty.exe
  C:\Windows\System\dkEavty.exe
  2⤵
  PID:3836
- C:\Windows\System\zqXSoDN.exe
  C:\Windows\System\zqXSoDN.exe
  2⤵
  PID:2232
- C:\Windows\System\BahZrGn.exe
  C:\Windows\System\BahZrGn.exe
  2⤵
  PID:3832
- C:\Windows\System\XHUfNdj.exe
  C:\Windows\System\XHUfNdj.exe
  2⤵
  PID:3816
- C:\Windows\System\kYRxFWK.exe
  C:\Windows\System\kYRxFWK.exe
  2⤵
  PID:3492
- C:\Windows\System\URyTjNf.exe
  C:\Windows\System\URyTjNf.exe
  2⤵
  PID:3288
- C:\Windows\System\anYtHVh.exe
  C:\Windows\System\anYtHVh.exe
  2⤵
  PID:3168
- C:\Windows\System\zEbqXun.exe
  C:\Windows\System\zEbqXun.exe
  2⤵
  PID:2684
- C:\Windows\System\oWgrBvi.exe
  C:\Windows\System\oWgrBvi.exe
  2⤵
  PID:3364
- C:\Windows\System\ksNRkht.exe
  C:\Windows\System\ksNRkht.exe
  2⤵
  PID:3252
- C:\Windows\System\wXFFzcL.exe
  C:\Windows\System\wXFFzcL.exe
  2⤵
  PID:3924
- C:\Windows\System\OvObDjS.exe
  C:\Windows\System\OvObDjS.exe
  2⤵
  PID:4076
- C:\Windows\System\frqHxtb.exe
  C:\Windows\System\frqHxtb.exe
  2⤵
  PID:2772
- C:\Windows\System\uypVnUN.exe
  C:\Windows\System\uypVnUN.exe
  2⤵
  PID:3784
- C:\Windows\System\VOMSFCN.exe
  C:\Windows\System\VOMSFCN.exe
  2⤵
  PID:3636
- C:\Windows\System\rhppvoo.exe
  C:\Windows\System\rhppvoo.exe
  2⤵
  PID:4008
- C:\Windows\System\eceBGjv.exe
  C:\Windows\System\eceBGjv.exe
  2⤵
  PID:3872
- C:\Windows\System\tCtchBu.exe
  C:\Windows\System\tCtchBu.exe
  2⤵
  PID:3152
- C:\Windows\System\FcHAjrc.exe
  C:\Windows\System\FcHAjrc.exe
  2⤵
  PID:3600
- C:\Windows\System\fyAfiZT.exe
  C:\Windows\System\fyAfiZT.exe
  2⤵
  PID:3972
- C:\Windows\System\cUhdEzv.exe
  C:\Windows\System\cUhdEzv.exe
  2⤵
  PID:2548
- C:\Windows\System\YDzvkvt.exe
  C:\Windows\System\YDzvkvt.exe
  2⤵
  PID:2816
- C:\Windows\System\EoSjqDs.exe
  C:\Windows\System\EoSjqDs.exe
  2⤵
  PID:1980
- C:\Windows\System\SkEVgLZ.exe
  C:\Windows\System\SkEVgLZ.exe
  2⤵
  PID:1328
- C:\Windows\System\aKSGGsI.exe
  C:\Windows\System\aKSGGsI.exe
  2⤵
  PID:2652
- C:\Windows\System\BSOxaXA.exe
  C:\Windows\System\BSOxaXA.exe
  2⤵
  PID:3140
- C:\Windows\System\UznHGab.exe
  C:\Windows\System\UznHGab.exe
  2⤵
  PID:4100
- C:\Windows\System\VkNOuzO.exe
  C:\Windows\System\VkNOuzO.exe
  2⤵
  PID:4116
- C:\Windows\System\jhPyvPK.exe
  C:\Windows\System\jhPyvPK.exe
  2⤵
  PID:4136
- C:\Windows\System\iIuSwIg.exe
  C:\Windows\System\iIuSwIg.exe
  2⤵
  PID:4152
- C:\Windows\System\jjwAKSJ.exe
  C:\Windows\System\jjwAKSJ.exe
  2⤵
  PID:4168
- C:\Windows\System\RjvSqTX.exe
  C:\Windows\System\RjvSqTX.exe
  2⤵
  PID:4184
- C:\Windows\System\hAxTPFC.exe
  C:\Windows\System\hAxTPFC.exe
  2⤵
  PID:4200
- C:\Windows\System\XufxfBa.exe
  C:\Windows\System\XufxfBa.exe
  2⤵
  PID:4220
- C:\Windows\System\oDmvpLe.exe
  C:\Windows\System\oDmvpLe.exe
  2⤵
  PID:4332
- C:\Windows\System\hPsUzdG.exe
  C:\Windows\System\hPsUzdG.exe
  2⤵
  PID:4348
- C:\Windows\System\mTCPaMq.exe
  C:\Windows\System\mTCPaMq.exe
  2⤵
  PID:4364
- C:\Windows\System\uxVJusB.exe
  C:\Windows\System\uxVJusB.exe
  2⤵
  PID:4380
- C:\Windows\System\sNLhVwB.exe
  C:\Windows\System\sNLhVwB.exe
  2⤵
  PID:4396
- C:\Windows\System\qbQGVQT.exe
  C:\Windows\System\qbQGVQT.exe
  2⤵
  PID:4412
- C:\Windows\System\zheLZyx.exe
  C:\Windows\System\zheLZyx.exe
  2⤵
  PID:4428
- C:\Windows\System\mizxXHL.exe
  C:\Windows\System\mizxXHL.exe
  2⤵
  PID:4444
- C:\Windows\System\LSRCSrv.exe
  C:\Windows\System\LSRCSrv.exe
  2⤵
  PID:4460
- C:\Windows\System\tyPWxkH.exe
  C:\Windows\System\tyPWxkH.exe
  2⤵
  PID:4476
- C:\Windows\System\rCVbYog.exe
  C:\Windows\System\rCVbYog.exe
  2⤵
  PID:4496
- C:\Windows\System\JRPDkmg.exe
  C:\Windows\System\JRPDkmg.exe
  2⤵
  PID:4512
- C:\Windows\System\EfHWQiV.exe
  C:\Windows\System\EfHWQiV.exe
  2⤵
  PID:4528
- C:\Windows\System\CIswCrx.exe
  C:\Windows\System\CIswCrx.exe
  2⤵
  PID:4544
- C:\Windows\System\uAElNYg.exe
  C:\Windows\System\uAElNYg.exe
  2⤵
  PID:4564
- C:\Windows\System\NcfsCJd.exe
  C:\Windows\System\NcfsCJd.exe
  2⤵
  PID:4580
- C:\Windows\System\giBMDVA.exe
  C:\Windows\System\giBMDVA.exe
  2⤵
  PID:4600
- C:\Windows\System\kPZSNUQ.exe
  C:\Windows\System\kPZSNUQ.exe
  2⤵
  PID:4620
- C:\Windows\System\GeJnzxR.exe
  C:\Windows\System\GeJnzxR.exe
  2⤵
  PID:4640
- C:\Windows\System\IABZaxC.exe
  C:\Windows\System\IABZaxC.exe
  2⤵
  PID:4656
- C:\Windows\System\rFJiYmw.exe
  C:\Windows\System\rFJiYmw.exe
  2⤵
  PID:4672
- C:\Windows\System\jVvtiwQ.exe
  C:\Windows\System\jVvtiwQ.exe
  2⤵
  PID:4688
- C:\Windows\System\rcunqnh.exe
  C:\Windows\System\rcunqnh.exe
  2⤵
  PID:4704
- C:\Windows\System\fkLZJmL.exe
  C:\Windows\System\fkLZJmL.exe
  2⤵
  PID:4748
- C:\Windows\System\TtUNHtE.exe
  C:\Windows\System\TtUNHtE.exe
  2⤵
  PID:4768
- C:\Windows\System\jizVGFE.exe
  C:\Windows\System\jizVGFE.exe
  2⤵
  PID:4796
- C:\Windows\System\opMKAAF.exe
  C:\Windows\System\opMKAAF.exe
  2⤵
  PID:4816
- C:\Windows\System\DaqdFLW.exe
  C:\Windows\System\DaqdFLW.exe
  2⤵
  PID:4832
- C:\Windows\System\OneIcOU.exe
  C:\Windows\System\OneIcOU.exe
  2⤵
  PID:4856
- C:\Windows\System\dtAdwiZ.exe
  C:\Windows\System\dtAdwiZ.exe
  2⤵
  PID:4876
- C:\Windows\System\YwPszSW.exe
  C:\Windows\System\YwPszSW.exe
  2⤵
  PID:4912
- C:\Windows\System\yPPhttf.exe
  C:\Windows\System\yPPhttf.exe
  2⤵
  PID:4932
- C:\Windows\System\QBRGQWA.exe
  C:\Windows\System\QBRGQWA.exe
  2⤵
  PID:4948
- C:\Windows\System\JyXJcbN.exe
  C:\Windows\System\JyXJcbN.exe
  2⤵
  PID:4964
- C:\Windows\System\fggTDNu.exe
  C:\Windows\System\fggTDNu.exe
  2⤵
  PID:4980
- C:\Windows\System\TMduTgM.exe
  C:\Windows\System\TMduTgM.exe
  2⤵
  PID:4996
- C:\Windows\System\COTUIYD.exe
  C:\Windows\System\COTUIYD.exe
  2⤵
  PID:5012
- C:\Windows\System\uyPjkpJ.exe
  C:\Windows\System\uyPjkpJ.exe
  2⤵
  PID:5092
- C:\Windows\System\YpExgJj.exe
  C:\Windows\System\YpExgJj.exe
  2⤵
  PID:5108
- C:\Windows\System\ZKrvjaQ.exe
  C:\Windows\System\ZKrvjaQ.exe
  2⤵
  PID:2408
- C:\Windows\System\HvUyLmf.exe
  C:\Windows\System\HvUyLmf.exe
  2⤵
  PID:4112
- C:\Windows\System\ztUFGIH.exe
  C:\Windows\System\ztUFGIH.exe
  2⤵
  PID:3820
- C:\Windows\System\iJfPWXY.exe
  C:\Windows\System\iJfPWXY.exe
  2⤵
  PID:4216
- C:\Windows\System\zCRaEBr.exe
  C:\Windows\System\zCRaEBr.exe
  2⤵
  PID:4192
- C:\Windows\System\BLEJKEQ.exe
  C:\Windows\System\BLEJKEQ.exe
  2⤵
  PID:4160
- C:\Windows\System\XogUMWZ.exe
  C:\Windows\System\XogUMWZ.exe
  2⤵
  PID:4292
- C:\Windows\System\zpFRxAI.exe
  C:\Windows\System\zpFRxAI.exe
  2⤵
  PID:4372
- C:\Windows\System\KvUKHya.exe
  C:\Windows\System\KvUKHya.exe
  2⤵
  PID:4436
- C:\Windows\System\jtHyfjp.exe
  C:\Windows\System\jtHyfjp.exe
  2⤵
  PID:4508
- C:\Windows\System\sdjuUqd.exe
  C:\Windows\System\sdjuUqd.exe
  2⤵
  PID:4312
- C:\Windows\System\irIgJAn.exe
  C:\Windows\System\irIgJAn.exe
  2⤵
  PID:4632
- C:\Windows\System\RiucvWu.exe
  C:\Windows\System\RiucvWu.exe
  2⤵
  PID:4320
- C:\Windows\System\RuQRSDF.exe
  C:\Windows\System\RuQRSDF.exe
  2⤵
  PID:4232
- C:\Windows\System\AcfEMKb.exe
  C:\Windows\System\AcfEMKb.exe
  2⤵
  PID:4424
- C:\Windows\System\gmfRfRg.exe
  C:\Windows\System\gmfRfRg.exe
  2⤵
  PID:4520
- C:\Windows\System\WrSpPYO.exe
  C:\Windows\System\WrSpPYO.exe
  2⤵
  PID:4636
- C:\Windows\System\mKqapKg.exe
  C:\Windows\System\mKqapKg.exe
  2⤵
  PID:4616
- C:\Windows\System\lCEBGss.exe
  C:\Windows\System\lCEBGss.exe
  2⤵
  PID:4712
- C:\Windows\System\gmXEear.exe
  C:\Windows\System\gmXEear.exe
  2⤵
  PID:4732
- C:\Windows\System\oQsbLUN.exe
  C:\Windows\System\oQsbLUN.exe
  2⤵
  PID:4788
- C:\Windows\System\tjwAaLg.exe
  C:\Windows\System\tjwAaLg.exe
  2⤵
  PID:4868
- C:\Windows\System\dZTAuaB.exe
  C:\Windows\System\dZTAuaB.exe
  2⤵
  PID:4356
- C:\Windows\System\eJWLPnI.exe
  C:\Windows\System\eJWLPnI.exe
  2⤵
  PID:4764
- C:\Windows\System\UMXdZMA.exe
  C:\Windows\System\UMXdZMA.exe
  2⤵
  PID:4944
- C:\Windows\System\uMvJRxJ.exe
  C:\Windows\System\uMvJRxJ.exe
  2⤵
  PID:4852
- C:\Windows\System\fVFdGnf.exe
  C:\Windows\System\fVFdGnf.exe
  2⤵
  PID:4892
- C:\Windows\System\YFHpkVg.exe
  C:\Windows\System\YFHpkVg.exe
  2⤵
  PID:4940
- C:\Windows\System\fIhultE.exe
  C:\Windows\System\fIhultE.exe
  2⤵
  PID:5036
- C:\Windows\System\IAqtVBX.exe
  C:\Windows\System\IAqtVBX.exe
  2⤵
  PID:5064
- C:\Windows\System\guklmNu.exe
  C:\Windows\System\guklmNu.exe
  2⤵
  PID:4256
- C:\Windows\System\cHpdmkq.exe
  C:\Windows\System\cHpdmkq.exe
  2⤵
  PID:5048
- C:\Windows\System\BWyhLHZ.exe
  C:\Windows\System\BWyhLHZ.exe
  2⤵
  PID:2668
- C:\Windows\System\WVafvtu.exe
  C:\Windows\System\WVafvtu.exe
  2⤵
  PID:4180
- C:\Windows\System\vnlFzDt.exe
  C:\Windows\System\vnlFzDt.exe
  2⤵
  PID:4108
- C:\Windows\System\gMpHTTK.exe
  C:\Windows\System\gMpHTTK.exe
  2⤵
  PID:4240
- C:\Windows\System\HDqKjLO.exe
  C:\Windows\System\HDqKjLO.exe
  2⤵
  PID:4260
- C:\Windows\System\buBDhkz.exe
  C:\Windows\System\buBDhkz.exe
  2⤵
  PID:4272
- C:\Windows\System\uiOKgoC.exe
  C:\Windows\System\uiOKgoC.exe
  2⤵
  PID:4288
- C:\Windows\System\aOwbzSz.exe
  C:\Windows\System\aOwbzSz.exe
  2⤵
  PID:1300
- C:\Windows\System\rtunSLO.exe
  C:\Windows\System\rtunSLO.exe
  2⤵
  PID:4128
- C:\Windows\System\ggpPeDv.exe
  C:\Windows\System\ggpPeDv.exe
  2⤵
  PID:4308
- C:\Windows\System\VBmncUp.exe
  C:\Windows\System\VBmncUp.exe
  2⤵
  PID:4696
- C:\Windows\System\rwiVdEg.exe
  C:\Windows\System\rwiVdEg.exe
  2⤵
  PID:4392
- C:\Windows\System\HlwnUKB.exe
  C:\Windows\System\HlwnUKB.exe
  2⤵
  PID:4596
- C:\Windows\System\FjzZzje.exe
  C:\Windows\System\FjzZzje.exe
  2⤵
  PID:4736
- C:\Windows\System\HJnSGkr.exe
  C:\Windows\System\HJnSGkr.exe
  2⤵
  PID:4784
- C:\Windows\System\QrqGpMI.exe
  C:\Windows\System\QrqGpMI.exe
  2⤵
  PID:4328
- C:\Windows\System\gKdzeWT.exe
  C:\Windows\System\gKdzeWT.exe
  2⤵
  PID:4724
- C:\Windows\System\VGWEDgl.exe
  C:\Windows\System\VGWEDgl.exe
  2⤵
  PID:4956
- C:\Windows\System\gYuofPj.exe
  C:\Windows\System\gYuofPj.exe
  2⤵
  PID:4928
- C:\Windows\System\CabFVdP.exe
  C:\Windows\System\CabFVdP.exe
  2⤵
  PID:4992
- C:\Windows\System\qJHaBXX.exe
  C:\Windows\System\qJHaBXX.exe
  2⤵
  PID:4972
- C:\Windows\System\ARgegHK.exe
  C:\Windows\System\ARgegHK.exe
  2⤵
  PID:4848
- C:\Windows\System\sOSqtAr.exe
  C:\Windows\System\sOSqtAr.exe
  2⤵
  PID:4844
- C:\Windows\System\AxUpGGL.exe
  C:\Windows\System\AxUpGGL.exe
  2⤵
  PID:4092
- C:\Windows\System\wRbBNau.exe
  C:\Windows\System\wRbBNau.exe
  2⤵
  PID:5052
- C:\Windows\System\EXzdQjR.exe
  C:\Windows\System\EXzdQjR.exe
  2⤵
  PID:5100
- C:\Windows\System\bGGQXAF.exe
  C:\Windows\System\bGGQXAF.exe
  2⤵
  PID:5104
- C:\Windows\System\UvHDhpj.exe
  C:\Windows\System\UvHDhpj.exe
  2⤵
  PID:4280
- C:\Windows\System\KUhQazo.exe
  C:\Windows\System\KUhQazo.exe
  2⤵
  PID:4284
- C:\Windows\System\gkOIbha.exe
  C:\Windows\System\gkOIbha.exe
  2⤵
  PID:4316
- C:\Windows\System\eqcEEgq.exe
  C:\Windows\System\eqcEEgq.exe
  2⤵
  PID:4344
- C:\Windows\System\xjNGOvY.exe
  C:\Windows\System\xjNGOvY.exe
  2⤵
  PID:4472
- C:\Windows\System\AxFGUhd.exe
  C:\Windows\System\AxFGUhd.exe
  2⤵
  PID:4684
- C:\Windows\System\DZoGlIa.exe
  C:\Windows\System\DZoGlIa.exe
  2⤵
  PID:4488
- C:\Windows\System\iiudKMS.exe
  C:\Windows\System\iiudKMS.exe
  2⤵
  PID:4484
- C:\Windows\System\kzDLsmb.exe
  C:\Windows\System\kzDLsmb.exe
  2⤵
  PID:4884
- C:\Windows\System\tjWZAeJ.exe
  C:\Windows\System\tjWZAeJ.exe
  2⤵
  PID:4504
- C:\Windows\System\PwRxvRd.exe
  C:\Windows\System\PwRxvRd.exe
  2⤵
  PID:4244
- C:\Windows\System\oawqnLu.exe
  C:\Windows\System\oawqnLu.exe
  2⤵
  PID:5116
- C:\Windows\System\BICFGQU.exe
  C:\Windows\System\BICFGQU.exe
  2⤵
  PID:4340
- C:\Windows\System\FcSlegR.exe
  C:\Windows\System\FcSlegR.exe
  2⤵
  PID:4540
- C:\Windows\System\oFIvFky.exe
  C:\Windows\System\oFIvFky.exe
  2⤵
  PID:4388
- C:\Windows\System\kBBJvNm.exe
  C:\Windows\System\kBBJvNm.exe
  2⤵
  PID:4924
- C:\Windows\System\irnAvTs.exe
  C:\Windows\System\irnAvTs.exe
  2⤵
  PID:4760
- C:\Windows\System\fsFQkhL.exe
  C:\Windows\System\fsFQkhL.exe
  2⤵
  PID:4904
- C:\Windows\System\sXBZKSf.exe
  C:\Windows\System\sXBZKSf.exe
  2⤵
  PID:5132
- C:\Windows\System\CinafYM.exe
  C:\Windows\System\CinafYM.exe
  2⤵
  PID:5148
- C:\Windows\System\WQnTzCz.exe
  C:\Windows\System\WQnTzCz.exe
  2⤵
  PID:5164
- C:\Windows\System\ZrZzYIa.exe
  C:\Windows\System\ZrZzYIa.exe
  2⤵
  PID:5184
- C:\Windows\System\xGPVaVI.exe
  C:\Windows\System\xGPVaVI.exe
  2⤵
  PID:5208
- C:\Windows\System\QRKGuns.exe
  C:\Windows\System\QRKGuns.exe
  2⤵
  PID:5224
- C:\Windows\System\wvKIJAl.exe
  C:\Windows\System\wvKIJAl.exe
  2⤵
  PID:5240
- C:\Windows\System\TdcAEIe.exe
  C:\Windows\System\TdcAEIe.exe
  2⤵
  PID:5260
- C:\Windows\System\OMwpXyV.exe
  C:\Windows\System\OMwpXyV.exe
  2⤵
  PID:5280
- C:\Windows\System\MqfAxIH.exe
  C:\Windows\System\MqfAxIH.exe
  2⤵
  PID:5296
- C:\Windows\System\QMzKEKq.exe
  C:\Windows\System\QMzKEKq.exe
  2⤵
  PID:5316
- C:\Windows\System\XKzVpWw.exe
  C:\Windows\System\XKzVpWw.exe
  2⤵
  PID:5332
- C:\Windows\System\kyRmtYg.exe
  C:\Windows\System\kyRmtYg.exe
  2⤵
  PID:5348
- C:\Windows\System\cWSnOKG.exe
  C:\Windows\System\cWSnOKG.exe
  2⤵
  PID:5368
- C:\Windows\System\hPInLpQ.exe
  C:\Windows\System\hPInLpQ.exe
  2⤵
  PID:5384
- C:\Windows\System\FqGOXOq.exe
  C:\Windows\System\FqGOXOq.exe
  2⤵
  PID:5400
- C:\Windows\System\ATcWCTj.exe
  C:\Windows\System\ATcWCTj.exe
  2⤵
  PID:5416
- C:\Windows\System\KfOTFBJ.exe
  C:\Windows\System\KfOTFBJ.exe
  2⤵
  PID:5436
- C:\Windows\System\lQgWmyi.exe
  C:\Windows\System\lQgWmyi.exe
  2⤵
  PID:5452
- C:\Windows\System\wXmLHxU.exe
  C:\Windows\System\wXmLHxU.exe
  2⤵
  PID:5472
- C:\Windows\System\yGNfSbu.exe
  C:\Windows\System\yGNfSbu.exe
  2⤵
  PID:5488
- C:\Windows\System\EJGRBsE.exe
  C:\Windows\System\EJGRBsE.exe
  2⤵
  PID:5504
- C:\Windows\System\PihoPAJ.exe
  C:\Windows\System\PihoPAJ.exe
  2⤵
  PID:5520
- C:\Windows\System\iQClHIk.exe
  C:\Windows\System\iQClHIk.exe
  2⤵
  PID:5540
- C:\Windows\System\Rpryzci.exe
  C:\Windows\System\Rpryzci.exe
  2⤵
  PID:5556
- C:\Windows\System\TTtUJmi.exe
  C:\Windows\System\TTtUJmi.exe
  2⤵
  PID:5572
- C:\Windows\System\OndrzVp.exe
  C:\Windows\System\OndrzVp.exe
  2⤵
  PID:5592
- C:\Windows\System\QaoPkqC.exe
  C:\Windows\System\QaoPkqC.exe
  2⤵
  PID:5608
- C:\Windows\System\wkDGMuR.exe
  C:\Windows\System\wkDGMuR.exe
  2⤵
  PID:5628
- C:\Windows\System\YSGVHOs.exe
  C:\Windows\System\YSGVHOs.exe
  2⤵
  PID:5644
- C:\Windows\System\ySLHDec.exe
  C:\Windows\System\ySLHDec.exe
  2⤵
  PID:5660
- C:\Windows\System\vQlRpns.exe
  C:\Windows\System\vQlRpns.exe
  2⤵
  PID:5684
- C:\Windows\System\aEQdJTd.exe
  C:\Windows\System\aEQdJTd.exe
  2⤵
  PID:5700
- C:\Windows\System\zAQNIhW.exe
  C:\Windows\System\zAQNIhW.exe
  2⤵
  PID:5716
- C:\Windows\System\XxNgSho.exe
  C:\Windows\System\XxNgSho.exe
  2⤵
  PID:5732
- C:\Windows\System\WNKvHNZ.exe
  C:\Windows\System\WNKvHNZ.exe
  2⤵
  PID:5748
- C:\Windows\System\QqlSeEp.exe
  C:\Windows\System\QqlSeEp.exe
  2⤵
  PID:5772
- C:\Windows\System\ljEtGvw.exe
  C:\Windows\System\ljEtGvw.exe
  2⤵
  PID:5788
- C:\Windows\System\XDmhHDy.exe
  C:\Windows\System\XDmhHDy.exe
  2⤵
  PID:5804
- C:\Windows\System\demxDLD.exe
  C:\Windows\System\demxDLD.exe
  2⤵
  PID:5820
- C:\Windows\System\tohlxlu.exe
  C:\Windows\System\tohlxlu.exe
  2⤵
  PID:5836
- C:\Windows\System\QpKLGPJ.exe
  C:\Windows\System\QpKLGPJ.exe
  2⤵
  PID:5864
- C:\Windows\System\IhjWbDH.exe
  C:\Windows\System\IhjWbDH.exe
  2⤵
  PID:5880
- C:\Windows\System\FvnSnhW.exe
  C:\Windows\System\FvnSnhW.exe
  2⤵
  PID:5896
- C:\Windows\System\EGeYnbB.exe
  C:\Windows\System\EGeYnbB.exe
  2⤵
  PID:5916
- C:\Windows\System\PuFwLqC.exe
  C:\Windows\System\PuFwLqC.exe
  2⤵
  PID:5932
- C:\Windows\System\ZzNMRIu.exe
  C:\Windows\System\ZzNMRIu.exe
  2⤵
  PID:5948
- C:\Windows\System\XCDyMmx.exe
  C:\Windows\System\XCDyMmx.exe
  2⤵
  PID:5964
- C:\Windows\System\YLVxity.exe
  C:\Windows\System\YLVxity.exe
  2⤵
  PID:5980
- C:\Windows\System\zAuPvKL.exe
  C:\Windows\System\zAuPvKL.exe
  2⤵
  PID:5996
- C:\Windows\System\fzbjvBc.exe
  C:\Windows\System\fzbjvBc.exe
  2⤵
  PID:6020
- C:\Windows\System\hciCxOn.exe
  C:\Windows\System\hciCxOn.exe
  2⤵
  PID:6040
- C:\Windows\System\fFqNOzh.exe
  C:\Windows\System\fFqNOzh.exe
  2⤵
  PID:6056
- C:\Windows\System\QjDFbyv.exe
  C:\Windows\System\QjDFbyv.exe
  2⤵
  PID:6072
- C:\Windows\System\hZjkGYo.exe
  C:\Windows\System\hZjkGYo.exe
  2⤵
  PID:6088
- C:\Windows\System\EeRzKTu.exe
  C:\Windows\System\EeRzKTu.exe
  2⤵
  PID:6104
- C:\Windows\System\hVgvVsH.exe
  C:\Windows\System\hVgvVsH.exe
  2⤵
  PID:6120
- C:\Windows\System\Zaivltn.exe
  C:\Windows\System\Zaivltn.exe
  2⤵
  PID:6140
- C:\Windows\System\jWELGpk.exe
  C:\Windows\System\jWELGpk.exe
  2⤵
  PID:4628
- C:\Windows\System\cFRGyJx.exe
  C:\Windows\System\cFRGyJx.exe
  2⤵
  PID:5176
- C:\Windows\System\jeGALxy.exe
  C:\Windows\System\jeGALxy.exe
  2⤵
  PID:5268
- C:\Windows\System\bBsmjnz.exe
  C:\Windows\System\bBsmjnz.exe
  2⤵
  PID:4248
- C:\Windows\System\tjJGScA.exe
  C:\Windows\System\tjJGScA.exe
  2⤵
  PID:4648
- C:\Windows\System\pczTwQr.exe
  C:\Windows\System\pczTwQr.exe
  2⤵
  PID:5156
- C:\Windows\System\uNLJwiT.exe
  C:\Windows\System\uNLJwiT.exe
  2⤵
  PID:5252
- C:\Windows\System\gZdLMrF.exe
  C:\Windows\System\gZdLMrF.exe
  2⤵
  PID:4840
- C:\Windows\System\URgoFfe.exe
  C:\Windows\System\URgoFfe.exe
  2⤵
  PID:5376
- C:\Windows\System\nosJCJO.exe
  C:\Windows\System\nosJCJO.exe
  2⤵
  PID:5344
- C:\Windows\System\wZdHjok.exe
  C:\Windows\System\wZdHjok.exe
  2⤵
  PID:5480
- C:\Windows\System\CngzHQe.exe
  C:\Windows\System\CngzHQe.exe
  2⤵
  PID:5512
- C:\Windows\System\XZYxqXt.exe
  C:\Windows\System\XZYxqXt.exe
  2⤵
  PID:5580
- C:\Windows\System\fhlbcQz.exe
  C:\Windows\System\fhlbcQz.exe
  2⤵
  PID:5620
- C:\Windows\System\SpgOELk.exe
  C:\Windows\System\SpgOELk.exe
  2⤵
  PID:5568
- C:\Windows\System\dsCcDrM.exe
  C:\Windows\System\dsCcDrM.exe
  2⤵
  PID:5356
- C:\Windows\System\PxzMZVo.exe
  C:\Windows\System\PxzMZVo.exe
  2⤵
  PID:5396
- C:\Windows\System\ZYqnoSZ.exe
  C:\Windows\System\ZYqnoSZ.exe
  2⤵
  PID:5500
- C:\Windows\System\KzimPGu.exe
  C:\Windows\System\KzimPGu.exe
  2⤵
  PID:5724
- C:\Windows\System\Pcqensy.exe
  C:\Windows\System\Pcqensy.exe
  2⤵
  PID:5764
- C:\Windows\System\gtQPrOC.exe
  C:\Windows\System\gtQPrOC.exe
  2⤵
  PID:5712
- C:\Windows\System\QdZocro.exe
  C:\Windows\System\QdZocro.exe
  2⤵
  PID:5636
- C:\Windows\System\RZjzfjo.exe
  C:\Windows\System\RZjzfjo.exe
  2⤵
  PID:5800
- C:\Windows\System\ZWhUniA.exe
  C:\Windows\System\ZWhUniA.exe
  2⤵
  PID:5744
- C:\Windows\System\rnWCQoC.exe
  C:\Windows\System\rnWCQoC.exe
  2⤵
  PID:5904
- C:\Windows\System\IMViApm.exe
  C:\Windows\System\IMViApm.exe
  2⤵
  PID:5940
- C:\Windows\System\mqSicWh.exe
  C:\Windows\System\mqSicWh.exe
  2⤵
  PID:5956
- C:\Windows\System\HyzpoWN.exe
  C:\Windows\System\HyzpoWN.exe
  2⤵
  PID:6052
- C:\Windows\System\VwcOsTS.exe
  C:\Windows\System\VwcOsTS.exe
  2⤵
  PID:6068
- C:\Windows\System\VOofbSV.exe
  C:\Windows\System\VOofbSV.exe
  2⤵
  PID:5232
- C:\Windows\System\WMQGdND.exe
  C:\Windows\System\WMQGdND.exe
  2⤵
  PID:5204
- C:\Windows\System\dSqBAsv.exe
  C:\Windows\System\dSqBAsv.exe
  2⤵
  PID:5312
- C:\Windows\System\KxsHHYe.exe
  C:\Windows\System\KxsHHYe.exe
  2⤵
  PID:5412
- C:\Windows\System\knrkeoi.exe
  C:\Windows\System\knrkeoi.exe
  2⤵
  PID:6136
- C:\Windows\System\lOmMRZg.exe
  C:\Windows\System\lOmMRZg.exe
  2⤵
  PID:5584
- C:\Windows\System\GQyMPLM.exe
  C:\Windows\System\GQyMPLM.exe
  2⤵
  PID:5468
- C:\Windows\System\JoHLayD.exe
  C:\Windows\System\JoHLayD.exe
  2⤵
  PID:5392
- C:\Windows\System\MZnKlgS.exe
  C:\Windows\System\MZnKlgS.exe
  2⤵
  PID:5692
- C:\Windows\System\uOJuhhW.exe
  C:\Windows\System\uOJuhhW.exe
  2⤵
  PID:5616
- C:\Windows\System\ApfYdKw.exe
  C:\Windows\System\ApfYdKw.exe
  2⤵
  PID:5292
- C:\Windows\System\modJyKf.exe
  C:\Windows\System\modJyKf.exe
  2⤵
  PID:5668
- C:\Windows\System\YIbtqlJ.exe
  C:\Windows\System\YIbtqlJ.exe
  2⤵
  PID:5872
- C:\Windows\System\sIigQfp.exe
  C:\Windows\System\sIigQfp.exe
  2⤵
  PID:5780
- C:\Windows\System\EVmwldj.exe
  C:\Windows\System\EVmwldj.exe
  2⤵
  PID:5816
- C:\Windows\System\nIMieAC.exe
  C:\Windows\System\nIMieAC.exe
  2⤵
  PID:5848
- C:\Windows\System\ZpeYYro.exe
  C:\Windows\System\ZpeYYro.exe
  2⤵
  PID:5960
- C:\Windows\System\IXnpuZX.exe
  C:\Windows\System\IXnpuZX.exe
  2⤵
  PID:2480
- C:\Windows\System\BCTOQti.exe
  C:\Windows\System\BCTOQti.exe
  2⤵
  PID:1908
- C:\Windows\System\JLfhbsC.exe
  C:\Windows\System\JLfhbsC.exe
  2⤵
  PID:5928
- C:\Windows\System\cdCNZWs.exe
  C:\Windows\System\cdCNZWs.exe
  2⤵
  PID:6064
- C:\Windows\System\tMLykwN.exe
  C:\Windows\System\tMLykwN.exe
  2⤵
  PID:4268
- C:\Windows\System\RWrSEft.exe
  C:\Windows\System\RWrSEft.exe
  2⤵
  PID:5308
- C:\Windows\System\nEgqxAH.exe
  C:\Windows\System\nEgqxAH.exe
  2⤵
  PID:5128
- C:\Windows\System\EjvmIZp.exe
  C:\Windows\System\EjvmIZp.exe
  2⤵
  PID:5256
- C:\Windows\System\LGPAeWx.exe
  C:\Windows\System\LGPAeWx.exe
  2⤵
  PID:5172
- C:\Windows\System\YFraxND.exe
  C:\Windows\System\YFraxND.exe
  2⤵
  PID:5528
- C:\Windows\System\pBALjrI.exe
  C:\Windows\System\pBALjrI.exe
  2⤵
  PID:5340
- C:\Windows\System\tzKsCZc.exe
  C:\Windows\System\tzKsCZc.exe
  2⤵
  PID:5876
- C:\Windows\System\QQFMxxE.exe
  C:\Windows\System\QQFMxxE.exe
  2⤵
  PID:5844
- C:\Windows\System\Bpjqwdo.exe
  C:\Windows\System\Bpjqwdo.exe
  2⤵
  PID:5860
- C:\Windows\System\MUabBJy.exe
  C:\Windows\System\MUabBJy.exe
  2⤵
  PID:5192
- C:\Windows\System\XMKhGgI.exe
  C:\Windows\System\XMKhGgI.exe
  2⤵
  PID:1604
- C:\Windows\System\YqzBktr.exe
  C:\Windows\System\YqzBktr.exe
  2⤵
  PID:5992
- C:\Windows\System\nsKglfH.exe
  C:\Windows\System\nsKglfH.exe
  2⤵
  PID:5976
- C:\Windows\System\WVLQZGk.exe
  C:\Windows\System\WVLQZGk.exe
  2⤵
  PID:6128
- C:\Windows\System\UmqQizq.exe
  C:\Windows\System\UmqQizq.exe
  2⤵
  PID:5656
- C:\Windows\System\OJnvrGy.exe
  C:\Windows\System\OJnvrGy.exe
  2⤵
  PID:2908
- C:\Windows\System\cdyAjGL.exe
  C:\Windows\System\cdyAjGL.exe
  2⤵
  PID:5756
- C:\Windows\System\uXzIlXl.exe
  C:\Windows\System\uXzIlXl.exe
  2⤵
  PID:5288
- C:\Windows\System\wvylnzH.exe
  C:\Windows\System\wvylnzH.exe
  2⤵
  PID:5432
- C:\Windows\System\nDIjuRB.exe
  C:\Windows\System\nDIjuRB.exe
  2⤵
  PID:6116
- C:\Windows\System\PLBEAGl.exe
  C:\Windows\System\PLBEAGl.exe
  2⤵
  PID:5740
- C:\Windows\System\gTjVeIF.exe
  C:\Windows\System\gTjVeIF.exe
  2⤵
  PID:5220
- C:\Windows\System\AtnRdNB.exe
  C:\Windows\System\AtnRdNB.exe
  2⤵
  PID:5364
- C:\Windows\System\YiJhmIQ.exe
  C:\Windows\System\YiJhmIQ.exe
  2⤵
  PID:6036
- C:\Windows\System\yCGCEfN.exe
  C:\Windows\System\yCGCEfN.exe
  2⤵
  PID:6148
- C:\Windows\System\sKGvjhm.exe
  C:\Windows\System\sKGvjhm.exe
  2⤵
  PID:6164
- C:\Windows\System\oIwdmxb.exe
  C:\Windows\System\oIwdmxb.exe
  2⤵
  PID:6180
- C:\Windows\System\VCHRtfo.exe
  C:\Windows\System\VCHRtfo.exe
  2⤵
  PID:6196
- C:\Windows\System\iouMTKx.exe
  C:\Windows\System\iouMTKx.exe
  2⤵
  PID:6212
- C:\Windows\System\eQctIIq.exe
  C:\Windows\System\eQctIIq.exe
  2⤵
  PID:6228
- C:\Windows\System\BfheRwk.exe
  C:\Windows\System\BfheRwk.exe
  2⤵
  PID:6244
- C:\Windows\System\tubarNs.exe
  C:\Windows\System\tubarNs.exe
  2⤵
  PID:6268
- C:\Windows\System\laaCccM.exe
  C:\Windows\System\laaCccM.exe
  2⤵
  PID:6284
- C:\Windows\System\CDYcfaJ.exe
  C:\Windows\System\CDYcfaJ.exe
  2⤵
  PID:6300
- C:\Windows\System\PDNuncu.exe
  C:\Windows\System\PDNuncu.exe
  2⤵
  PID:6316
- C:\Windows\System\OcBqRRg.exe
  C:\Windows\System\OcBqRRg.exe
  2⤵
  PID:6332
- C:\Windows\System\oEWMIDi.exe
  C:\Windows\System\oEWMIDi.exe
  2⤵
  PID:6352
- C:\Windows\System\NJJdgeK.exe
  C:\Windows\System\NJJdgeK.exe
  2⤵
  PID:6368
- C:\Windows\System\EdPVOvF.exe
  C:\Windows\System\EdPVOvF.exe
  2⤵
  PID:6384
- C:\Windows\System\fbcTpwr.exe
  C:\Windows\System\fbcTpwr.exe
  2⤵
  PID:6400
- C:\Windows\System\NwrLwTo.exe
  C:\Windows\System\NwrLwTo.exe
  2⤵
  PID:6416
- C:\Windows\System\yjLVxRV.exe
  C:\Windows\System\yjLVxRV.exe
  2⤵
  PID:6468
- C:\Windows\System\MrHwtfS.exe
  C:\Windows\System\MrHwtfS.exe
  2⤵
  PID:6488
- C:\Windows\System\VPlscFG.exe
  C:\Windows\System\VPlscFG.exe
  2⤵
  PID:6504
- C:\Windows\System\HLVgeyT.exe
  C:\Windows\System\HLVgeyT.exe
  2⤵
  PID:6524
- C:\Windows\System\baRaYLE.exe
  C:\Windows\System\baRaYLE.exe
  2⤵
  PID:6540
- C:\Windows\System\KgAOcjt.exe
  C:\Windows\System\KgAOcjt.exe
  2⤵
  PID:6560
- C:\Windows\System\erEhwMl.exe
  C:\Windows\System\erEhwMl.exe
  2⤵
  PID:6576
- C:\Windows\System\euiVvFr.exe
  C:\Windows\System\euiVvFr.exe
  2⤵
  PID:6592
- C:\Windows\System\liTUJVG.exe
  C:\Windows\System\liTUJVG.exe
  2⤵
  PID:6608
- C:\Windows\System\acbJXtX.exe
  C:\Windows\System\acbJXtX.exe
  2⤵
  PID:6636
- C:\Windows\System\YUCcxlB.exe
  C:\Windows\System\YUCcxlB.exe
  2⤵
  PID:6652
- C:\Windows\System\KYXykfX.exe
  C:\Windows\System\KYXykfX.exe
  2⤵
  PID:6668
- C:\Windows\System\FiaVcsB.exe
  C:\Windows\System\FiaVcsB.exe
  2⤵
  PID:6684
- C:\Windows\System\IDDDdUG.exe
  C:\Windows\System\IDDDdUG.exe
  2⤵
  PID:6704
- C:\Windows\System\MgJdoLN.exe
  C:\Windows\System\MgJdoLN.exe
  2⤵
  PID:6720
- C:\Windows\System\RELDRaT.exe
  C:\Windows\System\RELDRaT.exe
  2⤵
  PID:6744
- C:\Windows\System\daippzc.exe
  C:\Windows\System\daippzc.exe
  2⤵
  PID:6760
- C:\Windows\System\ayUewsE.exe
  C:\Windows\System\ayUewsE.exe
  2⤵
  PID:6776
- C:\Windows\System\dyAHsMi.exe
  C:\Windows\System\dyAHsMi.exe
  2⤵
  PID:6792
- C:\Windows\System\GKKlyEf.exe
  C:\Windows\System\GKKlyEf.exe
  2⤵
  PID:6808
- C:\Windows\System\eQJQJFi.exe
  C:\Windows\System\eQJQJFi.exe
  2⤵
  PID:6832
- C:\Windows\System\NkwUkFE.exe
  C:\Windows\System\NkwUkFE.exe
  2⤵
  PID:6848
- C:\Windows\System\rIaLcNp.exe
  C:\Windows\System\rIaLcNp.exe
  2⤵
  PID:6864
- C:\Windows\System\SisFGyy.exe
  C:\Windows\System\SisFGyy.exe
  2⤵
  PID:6880
- C:\Windows\System\tcdihjV.exe
  C:\Windows\System\tcdihjV.exe
  2⤵
  PID:6896
- C:\Windows\System\NaoiLIo.exe
  C:\Windows\System\NaoiLIo.exe
  2⤵
  PID:6916
- C:\Windows\System\ldofSpZ.exe
  C:\Windows\System\ldofSpZ.exe
  2⤵
  PID:6932
- C:\Windows\System\pLggldn.exe
  C:\Windows\System\pLggldn.exe
  2⤵
  PID:6948
- C:\Windows\System\ohmxJdj.exe
  C:\Windows\System\ohmxJdj.exe
  2⤵
  PID:6968
- C:\Windows\System\kWzeoSp.exe
  C:\Windows\System\kWzeoSp.exe
  2⤵
  PID:6984
- C:\Windows\System\BAqNzMf.exe
  C:\Windows\System\BAqNzMf.exe
  2⤵
  PID:7000
- C:\Windows\System\QjEdivo.exe
  C:\Windows\System\QjEdivo.exe
  2⤵
  PID:7024
- C:\Windows\System\OalLIPB.exe
  C:\Windows\System\OalLIPB.exe
  2⤵
  PID:7040
- C:\Windows\System\HIIuOqZ.exe
  C:\Windows\System\HIIuOqZ.exe
  2⤵
  PID:7056
- C:\Windows\System\HzeVbQk.exe
  C:\Windows\System\HzeVbQk.exe
  2⤵
  PID:7072
- C:\Windows\System\xkXbdlj.exe
  C:\Windows\System\xkXbdlj.exe
  2⤵
  PID:7088
- C:\Windows\System\yzthSjH.exe
  C:\Windows\System\yzthSjH.exe
  2⤵
  PID:7108
- C:\Windows\System\cYAzXwK.exe
  C:\Windows\System\cYAzXwK.exe
  2⤵
  PID:7124
- C:\Windows\System\mjlStHK.exe
  C:\Windows\System\mjlStHK.exe
  2⤵
  PID:7140
- C:\Windows\System\AFzHvEM.exe
  C:\Windows\System\AFzHvEM.exe
  2⤵
  PID:7160
- C:\Windows\System\uwxQoIP.exe
  C:\Windows\System\uwxQoIP.exe
  2⤵
  PID:6192
- C:\Windows\System\YrzLoyv.exe
  C:\Windows\System\YrzLoyv.exe
  2⤵
  PID:6204
- C:\Windows\System\PBQlcqh.exe
  C:\Windows\System\PBQlcqh.exe
  2⤵
  PID:6240
- C:\Windows\System\LLGbzON.exe
  C:\Windows\System\LLGbzON.exe
  2⤵
  PID:6296
- C:\Windows\System\DQfFyFT.exe
  C:\Windows\System\DQfFyFT.exe
  2⤵
  PID:6308
- C:\Windows\System\cSFOgnN.exe
  C:\Windows\System\cSFOgnN.exe
  2⤵
  PID:6280
- C:\Windows\System\MJOJrAH.exe
  C:\Windows\System\MJOJrAH.exe
  2⤵
  PID:6348
- C:\Windows\System\pQTaate.exe
  C:\Windows\System\pQTaate.exe
  2⤵
  PID:6380
- C:\Windows\System\zIEekZd.exe
  C:\Windows\System\zIEekZd.exe
  2⤵
  PID:6392
- C:\Windows\System\pElnXJi.exe
  C:\Windows\System\pElnXJi.exe
  2⤵
  PID:6436
- C:\Windows\System\isqdscy.exe
  C:\Windows\System\isqdscy.exe
  2⤵
  PID:6096
- C:\Windows\System\DPwGahG.exe
  C:\Windows\System\DPwGahG.exe
  2⤵
  PID:284
- C:\Windows\System\aVjxWDb.exe
  C:\Windows\System\aVjxWDb.exe
  2⤵
  PID:6536
- C:\Windows\System\IxrrShl.exe
  C:\Windows\System\IxrrShl.exe
  2⤵
  PID:6484
- C:\Windows\System\ZbbIKgF.exe
  C:\Windows\System\ZbbIKgF.exe
  2⤵
  PID:6512
- C:\Windows\System\iURbqWv.exe
  C:\Windows\System\iURbqWv.exe
  2⤵
  PID:6548
- C:\Windows\System\jlTZosu.exe
  C:\Windows\System\jlTZosu.exe
  2⤵
  PID:6644
- C:\Windows\System\PPAwCCs.exe
  C:\Windows\System\PPAwCCs.exe
  2⤵
  PID:6664
- C:\Windows\System\dTeOYmQ.exe
  C:\Windows\System\dTeOYmQ.exe
  2⤵
  PID:6696
- C:\Windows\System\kfpALBQ.exe
  C:\Windows\System\kfpALBQ.exe
  2⤵
  PID:6728
- C:\Windows\System\QMmAEtJ.exe
  C:\Windows\System\QMmAEtJ.exe
  2⤵
  PID:6768
- C:\Windows\System\SqZugDV.exe
  C:\Windows\System\SqZugDV.exe
  2⤵
  PID:6772
- C:\Windows\System\VfcVcTe.exe
  C:\Windows\System\VfcVcTe.exe
  2⤵
  PID:6804
- C:\Windows\System\uGIbUao.exe
  C:\Windows\System\uGIbUao.exe
  2⤵
  PID:6888
- C:\Windows\System\ZGyFvgO.exe
  C:\Windows\System\ZGyFvgO.exe
  2⤵
  PID:6960
- C:\Windows\System\gukdRlb.exe
  C:\Windows\System\gukdRlb.exe
  2⤵
  PID:6996
- C:\Windows\System\rueaYku.exe
  C:\Windows\System\rueaYku.exe
  2⤵
  PID:7032
- C:\Windows\System\mORbeIq.exe
  C:\Windows\System\mORbeIq.exe
  2⤵
  PID:6976
- C:\Windows\System\xtjYdOF.exe
  C:\Windows\System\xtjYdOF.exe
  2⤵
  PID:6912
- C:\Windows\System\exiNfJF.exe
  C:\Windows\System\exiNfJF.exe
  2⤵
  PID:7100
- C:\Windows\System\QdmlGPv.exe
  C:\Windows\System\QdmlGPv.exe
  2⤵
  PID:7132
- C:\Windows\System\xsReECb.exe
  C:\Windows\System\xsReECb.exe
  2⤵
  PID:7084
- C:\Windows\System\xsCipBk.exe
  C:\Windows\System\xsCipBk.exe
  2⤵
  PID:7048
- C:\Windows\System\EuRQgKh.exe
  C:\Windows\System\EuRQgKh.exe
  2⤵
  PID:7152
- C:\Windows\System\lSabmrR.exe
  C:\Windows\System\lSabmrR.exe
  2⤵
  PID:6220
- C:\Windows\System\AJtTCxY.exe
  C:\Windows\System\AJtTCxY.exe
  2⤵
  PID:6236
- C:\Windows\System\iWJAFdE.exe
  C:\Windows\System\iWJAFdE.exe
  2⤵
  PID:5496
- C:\Windows\System\ryjaExu.exe
  C:\Windows\System\ryjaExu.exe
  2⤵
  PID:6444
- C:\Windows\System\BeNlbzM.exe
  C:\Windows\System\BeNlbzM.exe
  2⤵
  PID:6376
- C:\Windows\System\afkHtEd.exe
  C:\Windows\System\afkHtEd.exe
  2⤵
  PID:6532
- C:\Windows\System\ibwYtEc.exe
  C:\Windows\System\ibwYtEc.exe
  2⤵
  PID:6624
- C:\Windows\System\MRnbGlL.exe
  C:\Windows\System\MRnbGlL.exe
  2⤵
  PID:6620
- C:\Windows\System\KOwxHEH.exe
  C:\Windows\System\KOwxHEH.exe
  2⤵
  PID:6712
- C:\Windows\System\UXbjWLP.exe
  C:\Windows\System\UXbjWLP.exe
  2⤵
  PID:6924
- C:\Windows\System\IuNWSyR.exe
  C:\Windows\System\IuNWSyR.exe
  2⤵
  PID:6956
- C:\Windows\System\yqOFXbi.exe
  C:\Windows\System\yqOFXbi.exe
  2⤵
  PID:6788
- C:\Windows\System\FmWTGGc.exe
  C:\Windows\System\FmWTGGc.exe
  2⤵
  PID:6892
- C:\Windows\System\CGZMMXo.exe
  C:\Windows\System\CGZMMXo.exe
  2⤵
  PID:6904
- C:\Windows\System\dkHGHYJ.exe
  C:\Windows\System\dkHGHYJ.exe
  2⤵
  PID:6908
- C:\Windows\System\wLjAgog.exe
  C:\Windows\System\wLjAgog.exe
  2⤵
  PID:6264
- C:\Windows\System\iMKrnHi.exe
  C:\Windows\System\iMKrnHi.exe
  2⤵
  PID:7068
- C:\Windows\System\McwdsUb.exe
  C:\Windows\System\McwdsUb.exe
  2⤵
  PID:7052
- C:\Windows\System\ngRHNgT.exe
  C:\Windows\System\ngRHNgT.exe
  2⤵
  PID:6016
- C:\Windows\System\StXGPqx.exe
  C:\Windows\System\StXGPqx.exe
  2⤵
  PID:6412
- C:\Windows\System\nXZCTXd.exe
  C:\Windows\System\nXZCTXd.exe
  2⤵
  PID:6600
- C:\Windows\System\WpsJFIV.exe
  C:\Windows\System\WpsJFIV.exe
  2⤵
  PID:6460
- C:\Windows\System\TZLzsfH.exe
  C:\Windows\System\TZLzsfH.exe
  2⤵
  PID:6520
- C:\Windows\System\oaYKksh.exe
  C:\Windows\System\oaYKksh.exe
  2⤵
  PID:6816
- C:\Windows\System\soRuLFz.exe
  C:\Windows\System\soRuLFz.exe
  2⤵
  PID:6844
- C:\Windows\System\EuSSivG.exe
  C:\Windows\System\EuSSivG.exe
  2⤵
  PID:6476
- C:\Windows\System\WnUAygK.exe
  C:\Windows\System\WnUAygK.exe
  2⤵
  PID:6452
- C:\Windows\System\SFRnhTf.exe
  C:\Windows\System\SFRnhTf.exe
  2⤵
  PID:6680
- C:\Windows\System\uuokmkB.exe
  C:\Windows\System\uuokmkB.exe
  2⤵
  PID:6292
- C:\Windows\System\ydgTdDX.exe
  C:\Windows\System\ydgTdDX.exe
  2⤵
  PID:6756
- C:\Windows\System\toOUZMI.exe
  C:\Windows\System\toOUZMI.exe
  2⤵
  PID:7180
- C:\Windows\System\AtFTwaO.exe
  C:\Windows\System\AtFTwaO.exe
  2⤵
  PID:7196
- C:\Windows\System\tvZVvOe.exe
  C:\Windows\System\tvZVvOe.exe
  2⤵
  PID:7220
- C:\Windows\System\YGVSlBJ.exe
  C:\Windows\System\YGVSlBJ.exe
  2⤵
  PID:7240
- C:\Windows\System\crVflLy.exe
  C:\Windows\System\crVflLy.exe
  2⤵
  PID:7256
- C:\Windows\System\KzrYsLr.exe
  C:\Windows\System\KzrYsLr.exe
  2⤵
  PID:7272
- C:\Windows\System\pqBMvkC.exe
  C:\Windows\System\pqBMvkC.exe
  2⤵
  PID:7288
- C:\Windows\System\PLsjBgp.exe
  C:\Windows\System\PLsjBgp.exe
  2⤵
  PID:7304
- C:\Windows\System\OlCCGDy.exe
  C:\Windows\System\OlCCGDy.exe
  2⤵
  PID:7324
- C:\Windows\System\ueLLmay.exe
  C:\Windows\System\ueLLmay.exe
  2⤵
  PID:7340
- C:\Windows\System\uBMjvMh.exe
  C:\Windows\System\uBMjvMh.exe
  2⤵
  PID:7356
- C:\Windows\System\OQLfXoC.exe
  C:\Windows\System\OQLfXoC.exe
  2⤵
  PID:7372
- C:\Windows\System\OBbhyyU.exe
  C:\Windows\System\OBbhyyU.exe
  2⤵
  PID:7388
- C:\Windows\System\mvlYYvz.exe
  C:\Windows\System\mvlYYvz.exe
  2⤵
  PID:7404
- C:\Windows\System\GCEeMby.exe
  C:\Windows\System\GCEeMby.exe
  2⤵
  PID:7420
- C:\Windows\System\JOshMaw.exe
  C:\Windows\System\JOshMaw.exe
  2⤵
  PID:7436
- C:\Windows\System\WsfwpAN.exe
  C:\Windows\System\WsfwpAN.exe
  2⤵
  PID:7452
- C:\Windows\System\PNHAKbh.exe
  C:\Windows\System\PNHAKbh.exe
  2⤵
  PID:7468
- C:\Windows\System\TyrHHpL.exe
  C:\Windows\System\TyrHHpL.exe
  2⤵
  PID:7484
- C:\Windows\System\UpBCGSd.exe
  C:\Windows\System\UpBCGSd.exe
  2⤵
  PID:7500
- C:\Windows\System\wdwNaPM.exe
  C:\Windows\System\wdwNaPM.exe
  2⤵
  PID:7520
- C:\Windows\System\vvvdzSU.exe
  C:\Windows\System\vvvdzSU.exe
  2⤵
  PID:7536
- C:\Windows\System\fxVBmqf.exe
  C:\Windows\System\fxVBmqf.exe
  2⤵
  PID:7552
- C:\Windows\System\tMHzsHT.exe
  C:\Windows\System\tMHzsHT.exe
  2⤵
  PID:7568
- C:\Windows\System\bwZuJtQ.exe
  C:\Windows\System\bwZuJtQ.exe
  2⤵
  PID:7584
- C:\Windows\System\ZzTUxnf.exe
  C:\Windows\System\ZzTUxnf.exe
  2⤵
  PID:7600
- C:\Windows\System\nSnmkww.exe
  C:\Windows\System\nSnmkww.exe
  2⤵
  PID:7620
- C:\Windows\System\tffKhCB.exe
  C:\Windows\System\tffKhCB.exe
  2⤵
  PID:7636
- C:\Windows\System\cOHtAGu.exe
  C:\Windows\System\cOHtAGu.exe
  2⤵
  PID:7652
- C:\Windows\System\ufDqntz.exe
  C:\Windows\System\ufDqntz.exe
  2⤵
  PID:7668
- C:\Windows\System\HqfBemg.exe
  C:\Windows\System\HqfBemg.exe
  2⤵
  PID:7688
- C:\Windows\System\XOotmUc.exe
  C:\Windows\System\XOotmUc.exe
  2⤵
  PID:7704
- C:\Windows\System\jnxeCon.exe
  C:\Windows\System\jnxeCon.exe
  2⤵
  PID:7724
- C:\Windows\System\GhkqfUC.exe
  C:\Windows\System\GhkqfUC.exe
  2⤵
  PID:7740
- C:\Windows\System\YAbYLTz.exe
  C:\Windows\System\YAbYLTz.exe
  2⤵
  PID:7760
- C:\Windows\System\rIVgjaG.exe
  C:\Windows\System\rIVgjaG.exe
  2⤵
  PID:7776
- C:\Windows\System\rAKaVnN.exe
  C:\Windows\System\rAKaVnN.exe
  2⤵
  PID:7792
- C:\Windows\System\UmrWAYe.exe
  C:\Windows\System\UmrWAYe.exe
  2⤵
  PID:7808
- C:\Windows\System\CCfIlfD.exe
  C:\Windows\System\CCfIlfD.exe
  2⤵
  PID:7824
- C:\Windows\System\sqpFyZU.exe
  C:\Windows\System\sqpFyZU.exe
  2⤵
  PID:7840
- C:\Windows\System\KtRVdjm.exe
  C:\Windows\System\KtRVdjm.exe
  2⤵
  PID:7860
- C:\Windows\System\KfQrLRS.exe
  C:\Windows\System\KfQrLRS.exe
  2⤵
  PID:7880
- C:\Windows\System\RFlNCbx.exe
  C:\Windows\System\RFlNCbx.exe
  2⤵
  PID:7896
- C:\Windows\System\bnJvtLf.exe
  C:\Windows\System\bnJvtLf.exe
  2⤵
  PID:7912
- C:\Windows\System\XSyXqAf.exe
  C:\Windows\System\XSyXqAf.exe
  2⤵
  PID:7928
- C:\Windows\System\VJUfnCN.exe
  C:\Windows\System\VJUfnCN.exe
  2⤵
  PID:7944
- C:\Windows\System\AvUWfnL.exe
  C:\Windows\System\AvUWfnL.exe
  2⤵
  PID:7960
- C:\Windows\System\puyFLOc.exe
  C:\Windows\System\puyFLOc.exe
  2⤵
  PID:7976
- C:\Windows\System\YVUAEPr.exe
  C:\Windows\System\YVUAEPr.exe
  2⤵
  PID:7992
- C:\Windows\System\iCkyEbj.exe
  C:\Windows\System\iCkyEbj.exe
  2⤵
  PID:8008
- C:\Windows\System\ZzPtRfK.exe
  C:\Windows\System\ZzPtRfK.exe
  2⤵
  PID:8024
- C:\Windows\System\CXdJBPO.exe
  C:\Windows\System\CXdJBPO.exe
  2⤵
  PID:8040
- C:\Windows\System\jcmoNzx.exe
  C:\Windows\System\jcmoNzx.exe
  2⤵
  PID:8076
- C:\Windows\System\mQmLWfi.exe
  C:\Windows\System\mQmLWfi.exe
  2⤵
  PID:8092
- C:\Windows\System\NEJiHyi.exe
  C:\Windows\System\NEJiHyi.exe
  2⤵
  PID:8108
- C:\Windows\System\PDjVYmQ.exe
  C:\Windows\System\PDjVYmQ.exe
  2⤵
  PID:8124
- C:\Windows\System\qouZVuR.exe
  C:\Windows\System\qouZVuR.exe
  2⤵
  PID:8140
- C:\Windows\System\NKVloVF.exe
  C:\Windows\System\NKVloVF.exe
  2⤵
  PID:8156
- C:\Windows\System\UeHMnss.exe
  C:\Windows\System\UeHMnss.exe
  2⤵
  PID:8176
- C:\Windows\System\ESjPrdp.exe
  C:\Windows\System\ESjPrdp.exe
  2⤵
  PID:7036
- C:\Windows\System\TtQHYOg.exe
  C:\Windows\System\TtQHYOg.exe
  2⤵
  PID:7116
- C:\Windows\System\mTeAfsB.exe
  C:\Windows\System\mTeAfsB.exe
  2⤵
  PID:7172
- C:\Windows\System\LYNhWVY.exe
  C:\Windows\System\LYNhWVY.exe
  2⤵
  PID:7216
- C:\Windows\System\MBJgHdr.exe
  C:\Windows\System\MBJgHdr.exe
  2⤵
  PID:6328
- C:\Windows\System\GtPSehV.exe
  C:\Windows\System\GtPSehV.exe
  2⤵
  PID:7280
- C:\Windows\System\hqZvPBF.exe
  C:\Windows\System\hqZvPBF.exe
  2⤵
  PID:7264
- C:\Windows\System\qtASLrU.exe
  C:\Windows\System\qtASLrU.exe
  2⤵
  PID:7312
- C:\Windows\System\BKugFUY.exe
  C:\Windows\System\BKugFUY.exe
  2⤵
  PID:7352
- C:\Windows\System\BUgtugL.exe
  C:\Windows\System\BUgtugL.exe
  2⤵
  PID:7416
- C:\Windows\System\vdgPZtD.exe
  C:\Windows\System\vdgPZtD.exe
  2⤵
  PID:7480
- C:\Windows\System\PGaPSsF.exe
  C:\Windows\System\PGaPSsF.exe
  2⤵
  PID:7516
- C:\Windows\System\jawVcSV.exe
  C:\Windows\System\jawVcSV.exe
  2⤵
  PID:7432
- C:\Windows\System\unXfdvs.exe
  C:\Windows\System\unXfdvs.exe
  2⤵
  PID:7336
- C:\Windows\System\ZLnPJnh.exe
  C:\Windows\System\ZLnPJnh.exe
  2⤵
  PID:7396
- C:\Windows\System\MOyFyGC.exe
  C:\Windows\System\MOyFyGC.exe
  2⤵
  PID:7560
- C:\Windows\System\QWUcrfe.exe
  C:\Windows\System\QWUcrfe.exe
  2⤵
  PID:7632
- C:\Windows\System\vOpThGk.exe
  C:\Windows\System\vOpThGk.exe
  2⤵
  PID:7768
- C:\Windows\System\mmXyiEf.exe
  C:\Windows\System\mmXyiEf.exe
  2⤵
  PID:7800
- C:\Windows\System\fzSmkXH.exe
  C:\Windows\System\fzSmkXH.exe
  2⤵
  PID:7832
- C:\Windows\System\GQzdrsz.exe
  C:\Windows\System\GQzdrsz.exe
  2⤵
  PID:7612
- C:\Windows\System\YKlYYyF.exe
  C:\Windows\System\YKlYYyF.exe
  2⤵
  PID:7680
- C:\Windows\System\ZZdPxht.exe
  C:\Windows\System\ZZdPxht.exe
  2⤵
  PID:7720
- C:\Windows\System\DCchDuL.exe
  C:\Windows\System\DCchDuL.exe
  2⤵
  PID:7788
- C:\Windows\System\ShPwmXG.exe
  C:\Windows\System\ShPwmXG.exe
  2⤵
  PID:7848
- C:\Windows\System\ERYGOqX.exe
  C:\Windows\System\ERYGOqX.exe
  2⤵
  PID:7868
- C:\Windows\System\SQVQzCA.exe
  C:\Windows\System\SQVQzCA.exe
  2⤵
  PID:7908
- C:\Windows\System\qEEUmVh.exe
  C:\Windows\System\qEEUmVh.exe
  2⤵
  PID:7956
- C:\Windows\System\jOrAGDi.exe
  C:\Windows\System\jOrAGDi.exe
  2⤵
  PID:8032
- C:\Windows\System\IreREJr.exe
  C:\Windows\System\IreREJr.exe
  2⤵
  PID:7988
- C:\Windows\System\nmXjGYb.exe
  C:\Windows\System\nmXjGYb.exe
  2⤵
  PID:8060
- C:\Windows\System\qdSOUmc.exe
  C:\Windows\System\qdSOUmc.exe
  2⤵
  PID:8056
- C:\Windows\System\JHuTHQA.exe
  C:\Windows\System\JHuTHQA.exe
  2⤵
  PID:7952
- C:\Windows\System\zxEdSxi.exe
  C:\Windows\System\zxEdSxi.exe
  2⤵
  PID:8164
- C:\Windows\System\gEnkUne.exe
  C:\Windows\System\gEnkUne.exe
  2⤵
  PID:8120
- C:\Windows\System\uRNvJts.exe
  C:\Windows\System\uRNvJts.exe
  2⤵
  PID:6632
- C:\Windows\System\kdzkgBb.exe
  C:\Windows\System\kdzkgBb.exe
  2⤵
  PID:7252
- C:\Windows\System\Daomfkg.exe
  C:\Windows\System\Daomfkg.exe
  2⤵
  PID:7136
- C:\Windows\System\ivFchye.exe
  C:\Windows\System\ivFchye.exe
  2⤵
  PID:7208
- C:\Windows\System\yqmBhFu.exe
  C:\Windows\System\yqmBhFu.exe
  2⤵
  PID:7412
- C:\Windows\System\WSnvukP.exe
  C:\Windows\System\WSnvukP.exe
  2⤵
  PID:7492
- C:\Windows\System\ssIEPgr.exe
  C:\Windows\System\ssIEPgr.exe
  2⤵
  PID:7464
- C:\Windows\System\EJykpBk.exe
  C:\Windows\System\EJykpBk.exe
  2⤵
  PID:7448
- C:\Windows\System\wEGOhzd.exe
  C:\Windows\System\wEGOhzd.exe
  2⤵
  PID:7548
- C:\Windows\System\OlhjTkF.exe
  C:\Windows\System\OlhjTkF.exe
  2⤵
  PID:7804
- C:\Windows\System\gXiragl.exe
  C:\Windows\System\gXiragl.exe
  2⤵
  PID:7676
- C:\Windows\System\MiPXHuR.exe
  C:\Windows\System\MiPXHuR.exe
  2⤵
  PID:7648
- C:\Windows\System\zxZqacx.exe
  C:\Windows\System\zxZqacx.exe
  2⤵
  PID:7784
- C:\Windows\System\OplTSyj.exe
  C:\Windows\System\OplTSyj.exe
  2⤵
  PID:7820
- C:\Windows\System\mZtHUFl.exe
  C:\Windows\System\mZtHUFl.exe
  2⤵
  PID:7876
- C:\Windows\System\uruuQoC.exe
  C:\Windows\System\uruuQoC.exe
  2⤵
  PID:7984
- C:\Windows\System\HRHwnhS.exe
  C:\Windows\System\HRHwnhS.exe
  2⤵
  PID:8068
- C:\Windows\System\yWXbyYm.exe
  C:\Windows\System\yWXbyYm.exe
  2⤵
  PID:8136
- C:\Windows\System\BlYOTMy.exe
  C:\Windows\System\BlYOTMy.exe
  2⤵
  PID:8052
- C:\Windows\System\KbmjvzV.exe
  C:\Windows\System\KbmjvzV.exe
  2⤵
  PID:7940
- C:\Windows\System\bSrYvJC.exe
  C:\Windows\System\bSrYvJC.exe
  2⤵
  PID:7188
- C:\Windows\System\KMkINbV.exe
  C:\Windows\System\KMkINbV.exe
  2⤵
  PID:6172
- C:\Windows\System\oHdBrZc.exe
  C:\Windows\System\oHdBrZc.exe
  2⤵
  PID:7428
- C:\Windows\System\sQicOTp.exe
  C:\Windows\System\sQicOTp.exe
  2⤵
  PID:7232
- C:\Windows\System\JHvYkdU.exe
  C:\Windows\System\JHvYkdU.exe
  2⤵
  PID:7608
- C:\Windows\System\ydKnjWt.exe
  C:\Windows\System\ydKnjWt.exe
  2⤵
  PID:7700
- C:\Windows\System\wfPdOba.exe
  C:\Windows\System\wfPdOba.exe
  2⤵
  PID:7752
- C:\Windows\System\zkIXLfN.exe
  C:\Windows\System\zkIXLfN.exe
  2⤵
  PID:7936
- C:\Windows\System\CDdzwKy.exe
  C:\Windows\System\CDdzwKy.exe
  2⤵
  PID:8152
- C:\Windows\System\ElJkuzI.exe
  C:\Windows\System\ElJkuzI.exe
  2⤵
  PID:8116
- C:\Windows\System\gJmZZbW.exe
  C:\Windows\System\gJmZZbW.exe
  2⤵
  PID:7512
- C:\Windows\System\mwGKOXR.exe
  C:\Windows\System\mwGKOXR.exe
  2⤵
  PID:7712
- C:\Windows\System\YokxEqK.exe
  C:\Windows\System\YokxEqK.exe
  2⤵
  PID:7772
- C:\Windows\System\rJBuZpJ.exe
  C:\Windows\System\rJBuZpJ.exe
  2⤵
  PID:8172
- C:\Windows\System\ahUpTlZ.exe
  C:\Windows\System\ahUpTlZ.exe
  2⤵
  PID:8004
- C:\Windows\System\LAbRkJr.exe
  C:\Windows\System\LAbRkJr.exe
  2⤵
  PID:8196
- C:\Windows\System\VoYIDaU.exe
  C:\Windows\System\VoYIDaU.exe
  2⤵
  PID:8216
- C:\Windows\System\ikolboH.exe
  C:\Windows\System\ikolboH.exe
  2⤵
  PID:8232
- C:\Windows\System\rHqGxCc.exe
  C:\Windows\System\rHqGxCc.exe
  2⤵
  PID:8252
- C:\Windows\System\GyRLehc.exe
  C:\Windows\System\GyRLehc.exe
  2⤵
  PID:8276
- C:\Windows\System\SjQJkMn.exe
  C:\Windows\System\SjQJkMn.exe
  2⤵
  PID:8292
- C:\Windows\System\uWwocKD.exe
  C:\Windows\System\uWwocKD.exe
  2⤵
  PID:8308
- C:\Windows\System\eVbNhJU.exe
  C:\Windows\System\eVbNhJU.exe
  2⤵
  PID:8324
- C:\Windows\System\kyVqeUH.exe
  C:\Windows\System\kyVqeUH.exe
  2⤵
  PID:8340
- C:\Windows\System\NAUEuCt.exe
  C:\Windows\System\NAUEuCt.exe
  2⤵
  PID:8360
- C:\Windows\System\ULDDSie.exe
  C:\Windows\System\ULDDSie.exe
  2⤵
  PID:8376
- C:\Windows\System\BeBVzFg.exe
  C:\Windows\System\BeBVzFg.exe
  2⤵
  PID:8392
- C:\Windows\System\xREKBWF.exe
  C:\Windows\System\xREKBWF.exe
  2⤵
  PID:8408
- C:\Windows\System\gTuSECk.exe
  C:\Windows\System\gTuSECk.exe
  2⤵
  PID:8424
- C:\Windows\System\fjFhrVb.exe
  C:\Windows\System\fjFhrVb.exe
  2⤵
  PID:8452
- C:\Windows\System\NVIqSKT.exe
  C:\Windows\System\NVIqSKT.exe
  2⤵
  PID:8472
- C:\Windows\System\ePwaXWu.exe
  C:\Windows\System\ePwaXWu.exe
  2⤵
  PID:8488
- C:\Windows\System\WFMVIgV.exe
  C:\Windows\System\WFMVIgV.exe
  2⤵
  PID:8508
- C:\Windows\System\ETfpyxz.exe
  C:\Windows\System\ETfpyxz.exe
  2⤵
  PID:8528
- C:\Windows\System\lutxytN.exe
  C:\Windows\System\lutxytN.exe
  2⤵
  PID:8544
- C:\Windows\System\MGyYHFN.exe
  C:\Windows\System\MGyYHFN.exe
  2⤵
  PID:8560
- C:\Windows\System\FqNbVwK.exe
  C:\Windows\System\FqNbVwK.exe
  2⤵
  PID:8580
- C:\Windows\System\jUOrUIP.exe
  C:\Windows\System\jUOrUIP.exe
  2⤵
  PID:8596
- C:\Windows\System\DOskfbV.exe
  C:\Windows\System\DOskfbV.exe
  2⤵
  PID:8616
- C:\Windows\System\xjhYzqX.exe
  C:\Windows\System\xjhYzqX.exe
  2⤵
  PID:8632
- C:\Windows\System\kBKgmPt.exe
  C:\Windows\System\kBKgmPt.exe
  2⤵
  PID:8648
- C:\Windows\System\esvXLKb.exe
  C:\Windows\System\esvXLKb.exe
  2⤵
  PID:8668
- C:\Windows\System\nmfZuBi.exe
  C:\Windows\System\nmfZuBi.exe
  2⤵
  PID:8684
- C:\Windows\System\cGjmxHP.exe
  C:\Windows\System\cGjmxHP.exe
  2⤵
  PID:8700
- C:\Windows\System\eGIZbQJ.exe
  C:\Windows\System\eGIZbQJ.exe
  2⤵
  PID:8716
- C:\Windows\System\XTlxDUs.exe
  C:\Windows\System\XTlxDUs.exe
  2⤵
  PID:8736
- C:\Windows\System\HcGQBTq.exe
  C:\Windows\System\HcGQBTq.exe
  2⤵
  PID:8752
- C:\Windows\System\maHklbD.exe
  C:\Windows\System\maHklbD.exe
  2⤵
  PID:8772
- C:\Windows\System\zplAQOP.exe
  C:\Windows\System\zplAQOP.exe
  2⤵
  PID:8800
- C:\Windows\System\ulOFYtv.exe
  C:\Windows\System\ulOFYtv.exe
  2⤵
  PID:8816
- C:\Windows\System\eqsIUCA.exe
  C:\Windows\System\eqsIUCA.exe
  2⤵
  PID:8836
- C:\Windows\System\fsZvGAA.exe
  C:\Windows\System\fsZvGAA.exe
  2⤵
  PID:8852
- C:\Windows\System\HlHHDrz.exe
  C:\Windows\System\HlHHDrz.exe
  2⤵
  PID:8868
- C:\Windows\System\moBXOhs.exe
  C:\Windows\System\moBXOhs.exe
  2⤵
  PID:8884
- C:\Windows\System\NhDCgDC.exe
  C:\Windows\System\NhDCgDC.exe
  2⤵
  PID:8900
- C:\Windows\System\LMvNpfc.exe
  C:\Windows\System\LMvNpfc.exe
  2⤵
  PID:8916
- C:\Windows\System\LEIgPPy.exe
  C:\Windows\System\LEIgPPy.exe
  2⤵
  PID:8932
- C:\Windows\System\CdqPuhu.exe
  C:\Windows\System\CdqPuhu.exe
  2⤵
  PID:8948
- C:\Windows\System\WWhWlfv.exe
  C:\Windows\System\WWhWlfv.exe
  2⤵
  PID:8968
- C:\Windows\System\HujSBDg.exe
  C:\Windows\System\HujSBDg.exe
  2⤵
  PID:8988
- C:\Windows\System\vpktaac.exe
  C:\Windows\System\vpktaac.exe
  2⤵
  PID:9008
- C:\Windows\System\pnjniXx.exe
  C:\Windows\System\pnjniXx.exe
  2⤵
  PID:9024
- C:\Windows\System\dWAqKzi.exe
  C:\Windows\System\dWAqKzi.exe
  2⤵
  PID:9040
- C:\Windows\System\SeqjEvr.exe
  C:\Windows\System\SeqjEvr.exe
  2⤵
  PID:9056
- C:\Windows\System\zCcQqll.exe
  C:\Windows\System\zCcQqll.exe
  2⤵
  PID:9076
- C:\Windows\System\qLIqECc.exe
  C:\Windows\System\qLIqECc.exe
  2⤵
  PID:9092
- C:\Windows\System\JfFQzMm.exe
  C:\Windows\System\JfFQzMm.exe
  2⤵
  PID:9112
- C:\Windows\System\GbUXPcF.exe
  C:\Windows\System\GbUXPcF.exe
  2⤵
  PID:9128
- C:\Windows\System\IoaOJQk.exe
  C:\Windows\System\IoaOJQk.exe
  2⤵
  PID:9144
- C:\Windows\System\UrxusZT.exe
  C:\Windows\System\UrxusZT.exe
  2⤵
  PID:9164
- C:\Windows\System\taBdQZM.exe
  C:\Windows\System\taBdQZM.exe
  2⤵
  PID:9180
- C:\Windows\System\hYFUBxQ.exe
  C:\Windows\System\hYFUBxQ.exe
  2⤵
  PID:9196
- C:\Windows\System\LhWoilW.exe
  C:\Windows\System\LhWoilW.exe
  2⤵
  PID:8168
- C:\Windows\System\VhJAYSS.exe
  C:\Windows\System\VhJAYSS.exe
  2⤵
  PID:8208
- C:\Windows\System\WXuqJBo.exe
  C:\Windows\System\WXuqJBo.exe
  2⤵
  PID:8240
- C:\Windows\System\kCSdxcf.exe
  C:\Windows\System\kCSdxcf.exe
  2⤵
  PID:7904
- C:\Windows\System\KGtQJwY.exe
  C:\Windows\System\KGtQJwY.exe
  2⤵
  PID:8288
- C:\Windows\System\OuJmAzI.exe
  C:\Windows\System\OuJmAzI.exe
  2⤵
  PID:8228
- C:\Windows\System\leUlaDu.exe
  C:\Windows\System\leUlaDu.exe
  2⤵
  PID:8348
- C:\Windows\System\FxGnIFF.exe
  C:\Windows\System\FxGnIFF.exe
  2⤵
  PID:8388
- C:\Windows\System\nuzPosu.exe
  C:\Windows\System\nuzPosu.exe
  2⤵
  PID:8432
- C:\Windows\System\NlYphft.exe
  C:\Windows\System\NlYphft.exe
  2⤵
  PID:8444
- C:\Windows\System\ZwgCjMR.exe
  C:\Windows\System\ZwgCjMR.exe
  2⤵
  PID:8464
- C:\Windows\System\kcGgffS.exe
  C:\Windows\System\kcGgffS.exe
  2⤵
  PID:8524
- C:\Windows\System\kmgtwIl.exe
  C:\Windows\System\kmgtwIl.exe
  2⤵
  PID:8468
- C:\Windows\System\jhEUQEP.exe
  C:\Windows\System\jhEUQEP.exe
  2⤵
  PID:8540
- C:\Windows\System\wXwpxJi.exe
  C:\Windows\System\wXwpxJi.exe
  2⤵
  PID:8572
- C:\Windows\System\bKowxhS.exe
  C:\Windows\System\bKowxhS.exe
  2⤵
  PID:8644
- C:\Windows\System\keZxvIV.exe
  C:\Windows\System\keZxvIV.exe
  2⤵
  PID:8708
- C:\Windows\System\MCjiHet.exe
  C:\Windows\System\MCjiHet.exe
  2⤵
  PID:8656
- C:\Windows\System\fsCqrpP.exe
  C:\Windows\System\fsCqrpP.exe
  2⤵
  PID:8712
- C:\Windows\System\jglWRHs.exe
  C:\Windows\System\jglWRHs.exe
  2⤵
  PID:8784
- C:\Windows\System\jUIFlxo.exe
  C:\Windows\System\jUIFlxo.exe
  2⤵
  PID:8732
- C:\Windows\System\qhjrLjN.exe
  C:\Windows\System\qhjrLjN.exe
  2⤵
  PID:8864
- C:\Windows\System\EsKQqQn.exe
  C:\Windows\System\EsKQqQn.exe
  2⤵
  PID:8896
- C:\Windows\System\dfkXYEK.exe
  C:\Windows\System\dfkXYEK.exe
  2⤵
  PID:8924
- C:\Windows\System\gcIRlGQ.exe
  C:\Windows\System\gcIRlGQ.exe
  2⤵
  PID:8964
- C:\Windows\System\CfgEDzH.exe
  C:\Windows\System\CfgEDzH.exe
  2⤵
  PID:8912
- C:\Windows\System\bKdgQQn.exe
  C:\Windows\System\bKdgQQn.exe
  2⤵
  PID:8980
- C:\Windows\System\pYmqsqE.exe
  C:\Windows\System\pYmqsqE.exe
  2⤵
  PID:9088
- C:\Windows\System\KqPcfMn.exe
  C:\Windows\System\KqPcfMn.exe
  2⤵
  PID:9156
- C:\Windows\System\CaQePAG.exe
  C:\Windows\System\CaQePAG.exe
  2⤵
  PID:9100
- C:\Windows\System\tlxRwWs.exe
  C:\Windows\System\tlxRwWs.exe
  2⤵
  PID:9036
- C:\Windows\System\MGllmFS.exe
  C:\Windows\System\MGllmFS.exe
  2⤵
  PID:9136
- C:\Windows\System\olRbYJj.exe
  C:\Windows\System\olRbYJj.exe
  2⤵
  PID:9212
- C:\Windows\System\bYmryZV.exe
  C:\Windows\System\bYmryZV.exe
  2⤵
  PID:7596
- C:\Windows\System\LpoTtYF.exe
  C:\Windows\System\LpoTtYF.exe
  2⤵
  PID:8204
- C:\Windows\System\jEzmfKq.exe
  C:\Windows\System\jEzmfKq.exe
  2⤵
  PID:8316
- C:\Windows\System\SNCqToJ.exe
  C:\Windows\System\SNCqToJ.exe
  2⤵
  PID:8264
- C:\Windows\System\YmTripi.exe
  C:\Windows\System\YmTripi.exe
  2⤵
  PID:8368
- C:\Windows\System\NrkykYy.exe
  C:\Windows\System\NrkykYy.exe
  2⤵
  PID:8460
- C:\Windows\System\yUDbtRP.exe
  C:\Windows\System\yUDbtRP.exe
  2⤵
  PID:8436
- C:\Windows\System\anwfvQu.exe
  C:\Windows\System\anwfvQu.exe
  2⤵
  PID:8536
- C:\Windows\System\THSLdTE.exe
  C:\Windows\System\THSLdTE.exe
  2⤵
  PID:8604
- C:\Windows\System\NGOcvsR.exe
  C:\Windows\System\NGOcvsR.exe
  2⤵
  PID:8860
- C:\Windows\System\oQgDxBu.exe
  C:\Windows\System\oQgDxBu.exe
  2⤵
  PID:8824
- C:\Windows\System\ukSbNPp.exe
  C:\Windows\System\ukSbNPp.exe
  2⤵
  PID:8812
- C:\Windows\System\xnJgEEc.exe
  C:\Windows\System\xnJgEEc.exe
  2⤵
  PID:8976
- C:\Windows\System\EPrCCYs.exe
  C:\Windows\System\EPrCCYs.exe
  2⤵
  PID:9004
- C:\Windows\System\vohTWsG.exe
  C:\Windows\System\vohTWsG.exe
  2⤵
  PID:8908
- C:\Windows\System\iAzHcYa.exe
  C:\Windows\System\iAzHcYa.exe
  2⤵
  PID:9108
- C:\Windows\System\ObtZVhN.exe
  C:\Windows\System\ObtZVhN.exe
  2⤵
  PID:8248
- C:\Windows\System\rcrABAx.exe
  C:\Windows\System\rcrABAx.exe
  2⤵
  PID:7696
- C:\Windows\System\BFIbDto.exe
  C:\Windows\System\BFIbDto.exe
  2⤵
  PID:9064
- C:\Windows\System\kknaDcy.exe
  C:\Windows\System\kknaDcy.exe
  2⤵
  PID:8664
- C:\Windows\System\MvbLDtZ.exe
  C:\Windows\System\MvbLDtZ.exe
  2⤵
  PID:8132
- C:\Windows\System\DDALydx.exe
  C:\Windows\System\DDALydx.exe
  2⤵
  PID:9068
- C:\Windows\System\HXPqszJ.exe
  C:\Windows\System\HXPqszJ.exe
  2⤵
  PID:9084
- C:\Windows\System\yVLJRvp.exe
  C:\Windows\System\yVLJRvp.exe
  2⤵
  PID:8212
- C:\Windows\System\rgyoRCW.exe
  C:\Windows\System\rgyoRCW.exe
  2⤵
  PID:8892
- C:\Windows\System\PezmOjP.exe
  C:\Windows\System\PezmOjP.exe
  2⤵
  PID:9208
- C:\Windows\System\WbjgggT.exe
  C:\Windows\System\WbjgggT.exe
  2⤵
  PID:8944
- C:\Windows\System\hvDQYbt.exe
  C:\Windows\System\hvDQYbt.exe
  2⤵
  PID:8728
- C:\Windows\System\slwmdlu.exe
  C:\Windows\System\slwmdlu.exe
  2⤵
  PID:8764
- C:\Windows\System\oJaOiiE.exe
  C:\Windows\System\oJaOiiE.exe
  2⤵
  PID:9032
- C:\Windows\System\MasUqEX.exe
  C:\Windows\System\MasUqEX.exe
  2⤵
  PID:8336
- C:\Windows\System\yTvxgnk.exe
  C:\Windows\System\yTvxgnk.exe
  2⤵
  PID:8272
- C:\Windows\System\vUGzMkk.exe
  C:\Windows\System\vUGzMkk.exe
  2⤵
  PID:8928
- C:\Windows\System\hzkKrDh.exe
  C:\Windows\System\hzkKrDh.exe
  2⤵
  PID:8304
- C:\Windows\System\sMOGRoW.exe
  C:\Windows\System\sMOGRoW.exe
  2⤵
  PID:8640
- C:\Windows\System\huLShNW.exe
  C:\Windows\System\huLShNW.exe
  2⤵
  PID:9232
- C:\Windows\System\PWtuEHm.exe
  C:\Windows\System\PWtuEHm.exe
  2⤵
  PID:9252
- C:\Windows\System\WfMCMmt.exe
  C:\Windows\System\WfMCMmt.exe
  2⤵
  PID:9308
- C:\Windows\System\wAXczdf.exe
  C:\Windows\System\wAXczdf.exe
  2⤵
  PID:9328
- C:\Windows\System\gFmMWzy.exe
  C:\Windows\System\gFmMWzy.exe
  2⤵
  PID:9344
- C:\Windows\System\EURkYLb.exe
  C:\Windows\System\EURkYLb.exe
  2⤵
  PID:9364
- C:\Windows\System\gMJZwia.exe
  C:\Windows\System\gMJZwia.exe
  2⤵
  PID:9380
- C:\Windows\System\kBnSGjv.exe
  C:\Windows\System\kBnSGjv.exe
  2⤵
  PID:9396
- C:\Windows\System\oghVLUa.exe
  C:\Windows\System\oghVLUa.exe
  2⤵
  PID:9412
- C:\Windows\System\rATOCMc.exe
  C:\Windows\System\rATOCMc.exe
  2⤵
  PID:9432
- C:\Windows\System\ZZcFxcR.exe
  C:\Windows\System\ZZcFxcR.exe
  2⤵
  PID:9460
- C:\Windows\System\ohRRLyQ.exe
  C:\Windows\System\ohRRLyQ.exe
  2⤵
  PID:9480
- C:\Windows\System\vEWnpIH.exe
  C:\Windows\System\vEWnpIH.exe
  2⤵
  PID:9500
- C:\Windows\System\tclMfZs.exe
  C:\Windows\System\tclMfZs.exe
  2⤵
  PID:9516
- C:\Windows\System\GwxNGln.exe
  C:\Windows\System\GwxNGln.exe
  2⤵
  PID:9532
- C:\Windows\System\njuEdCB.exe
  C:\Windows\System\njuEdCB.exe
  2⤵
  PID:9548
- C:\Windows\System\SwgTulT.exe
  C:\Windows\System\SwgTulT.exe
  2⤵
  PID:9572
- C:\Windows\System\jIxOwkZ.exe
  C:\Windows\System\jIxOwkZ.exe
  2⤵
  PID:9592
- C:\Windows\System\ODwYydk.exe
  C:\Windows\System\ODwYydk.exe
  2⤵
  PID:9608
- C:\Windows\System\YWLAviJ.exe
  C:\Windows\System\YWLAviJ.exe
  2⤵
  PID:9624
- C:\Windows\System\QwgnmxF.exe
  C:\Windows\System\QwgnmxF.exe
  2⤵
  PID:9640
- C:\Windows\System\hhLfwpP.exe
  C:\Windows\System\hhLfwpP.exe
  2⤵
  PID:9656
- C:\Windows\System\FclOIDM.exe
  C:\Windows\System\FclOIDM.exe
  2⤵
  PID:9672
- C:\Windows\System\gFbQeYN.exe
  C:\Windows\System\gFbQeYN.exe
  2⤵
  PID:9688
- C:\Windows\System\uNzRvnf.exe
  C:\Windows\System\uNzRvnf.exe
  2⤵
  PID:9716
- C:\Windows\System\QdnPmNn.exe
  C:\Windows\System\QdnPmNn.exe
  2⤵
  PID:9732
- C:\Windows\System\xUyPsUc.exe
  C:\Windows\System\xUyPsUc.exe
  2⤵
  PID:9748
- C:\Windows\System\fIOJEDA.exe
  C:\Windows\System\fIOJEDA.exe
  2⤵
  PID:9768
- C:\Windows\System\TMAjaeM.exe
  C:\Windows\System\TMAjaeM.exe
  2⤵
  PID:9784
- C:\Windows\System\FlKxkzi.exe
  C:\Windows\System\FlKxkzi.exe
  2⤵
  PID:9800
- C:\Windows\System\AmaZfAo.exe
  C:\Windows\System\AmaZfAo.exe
  2⤵
  PID:9816
- C:\Windows\System\BCbDVme.exe
  C:\Windows\System\BCbDVme.exe
  2⤵
  PID:9844
- C:\Windows\System\PygFiIs.exe
  C:\Windows\System\PygFiIs.exe
  2⤵
  PID:9864
- C:\Windows\System\NUkiuQC.exe
  C:\Windows\System\NUkiuQC.exe
  2⤵
  PID:9880
- C:\Windows\System\FWiarPP.exe
  C:\Windows\System\FWiarPP.exe
  2⤵
  PID:9896
- C:\Windows\System\LEFOybq.exe
  C:\Windows\System\LEFOybq.exe
  2⤵
  PID:9912
- C:\Windows\System\wejQjBq.exe
  C:\Windows\System\wejQjBq.exe
  2⤵
  PID:9928
- C:\Windows\System\oTEcgtE.exe
  C:\Windows\System\oTEcgtE.exe
  2⤵
  PID:9944
- C:\Windows\System\UVBfaqV.exe
  C:\Windows\System\UVBfaqV.exe
  2⤵
  PID:10008
- C:\Windows\System\EEKPjBt.exe
  C:\Windows\System\EEKPjBt.exe
  2⤵
  PID:10032
- C:\Windows\System\WUibtEq.exe
  C:\Windows\System\WUibtEq.exe
  2⤵
  PID:10048
- C:\Windows\System\OvsGIdu.exe
  C:\Windows\System\OvsGIdu.exe
  2⤵
  PID:10068
- C:\Windows\System\GVzvVok.exe
  C:\Windows\System\GVzvVok.exe
  2⤵
  PID:10088
- C:\Windows\System\wqtTBeT.exe
  C:\Windows\System\wqtTBeT.exe
  2⤵
  PID:10104
- C:\Windows\System\PkCDavy.exe
  C:\Windows\System\PkCDavy.exe
  2⤵
  PID:10120
- C:\Windows\System\MAOyekA.exe
  C:\Windows\System\MAOyekA.exe
  2⤵
  PID:10136
- C:\Windows\System\kxjuveC.exe
  C:\Windows\System\kxjuveC.exe
  2⤵
  PID:10152
- C:\Windows\System\TMIRWNu.exe
  C:\Windows\System\TMIRWNu.exe
  2⤵
  PID:10168
- C:\Windows\System\JRvZOhr.exe
  C:\Windows\System\JRvZOhr.exe
  2⤵
  PID:10184
- C:\Windows\System\ZcmoQoA.exe
  C:\Windows\System\ZcmoQoA.exe
  2⤵
  PID:10200
- C:\Windows\System\sgohCMB.exe
  C:\Windows\System\sgohCMB.exe
  2⤵
  PID:10216
- C:\Windows\System\AnqpOTS.exe
  C:\Windows\System\AnqpOTS.exe
  2⤵
  PID:10236
- C:\Windows\System\ntnftfb.exe
  C:\Windows\System\ntnftfb.exe
  2⤵
  PID:9240
- C:\Windows\System\oTawFOk.exe
  C:\Windows\System\oTawFOk.exe
  2⤵
  PID:8568
- C:\Windows\System\xvLUcid.exe
  C:\Windows\System\xvLUcid.exe
  2⤵
  PID:9224
- C:\Windows\System\wjJtKma.exe
  C:\Windows\System\wjJtKma.exe
  2⤵
  PID:9276
- C:\Windows\System\mcmAeHp.exe
  C:\Windows\System\mcmAeHp.exe
  2⤵
  PID:9292
- C:\Windows\System\PcaoeAg.exe
  C:\Windows\System\PcaoeAg.exe
  2⤵
  PID:9300
- C:\Windows\System\ZwHcuph.exe
  C:\Windows\System\ZwHcuph.exe
  2⤵
  PID:9388
- C:\Windows\System\MPcIZSi.exe
  C:\Windows\System\MPcIZSi.exe
  2⤵
  PID:9376
- C:\Windows\System\ZpgcveX.exe
  C:\Windows\System\ZpgcveX.exe
  2⤵
  PID:9392
- C:\Windows\System\BdRtjrt.exe
  C:\Windows\System\BdRtjrt.exe
  2⤵
  PID:9428
- C:\Windows\System\tqnJQkC.exe
  C:\Windows\System\tqnJQkC.exe
  2⤵
  PID:9472
- C:\Windows\System\LmRDaRT.exe
  C:\Windows\System\LmRDaRT.exe
  2⤵
  PID:9508
- C:\Windows\System\FFWIrrD.exe
  C:\Windows\System\FFWIrrD.exe
  2⤵
  PID:9568
- C:\Windows\System\KfokEFM.exe
  C:\Windows\System\KfokEFM.exe
  2⤵
  PID:9512
- C:\Windows\System\KUvloRp.exe
  C:\Windows\System\KUvloRp.exe
  2⤵
  PID:9652
- C:\Windows\System\QBZoEFE.exe
  C:\Windows\System\QBZoEFE.exe
  2⤵
  PID:9496
- C:\Windows\System\zvgFEJb.exe
  C:\Windows\System\zvgFEJb.exe
  2⤵
  PID:9728
- C:\Windows\System\rUYKTHp.exe
  C:\Windows\System\rUYKTHp.exe
  2⤵
  PID:9780
- C:\Windows\System\QhjMokG.exe
  C:\Windows\System\QhjMokG.exe
  2⤵
  PID:9740
- C:\Windows\System\ofHSJaB.exe
  C:\Windows\System\ofHSJaB.exe
  2⤵
  PID:9888
- C:\Windows\System\MMRggxX.exe
  C:\Windows\System\MMRggxX.exe
  2⤵
  PID:9956
- C:\Windows\System\qIeZzKv.exe
  C:\Windows\System\qIeZzKv.exe
  2⤵
  PID:10016
- C:\Windows\System\kETvrYC.exe
  C:\Windows\System\kETvrYC.exe
  2⤵
  PID:10100
- C:\Windows\System\gSHtAPh.exe
  C:\Windows\System\gSHtAPh.exe
  2⤵
  PID:10164
- C:\Windows\System\TmHhrur.exe
  C:\Windows\System\TmHhrur.exe
  2⤵
  PID:10224
- C:\Windows\System\uTZBuxC.exe
  C:\Windows\System\uTZBuxC.exe
  2⤵
  PID:10144
- C:\Windows\System\FqVEURq.exe
  C:\Windows\System\FqVEURq.exe
  2⤵
  PID:9960
- C:\Windows\System\OyWPyHL.exe
  C:\Windows\System\OyWPyHL.exe
  2⤵
  PID:9972
- C:\Windows\System\dupksRf.exe
  C:\Windows\System\dupksRf.exe
  2⤵
  PID:9952
- C:\Windows\System\InuaafW.exe
  C:\Windows\System\InuaafW.exe
  2⤵
  PID:10080
- C:\Windows\System\aCREOXf.exe
  C:\Windows\System\aCREOXf.exe
  2⤵
  PID:10208
- C:\Windows\System\PaqcRAs.exe
  C:\Windows\System\PaqcRAs.exe
  2⤵
  PID:9980
- C:\Windows\System\PQndRev.exe
  C:\Windows\System\PQndRev.exe
  2⤵
  PID:10000
- C:\Windows\System\BtverPj.exe
  C:\Windows\System\BtverPj.exe
  2⤵
  PID:9320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AuteJKR.exe

Filesize
1.9MB

MD5
1b0f2676d03f39a1fbb902f6d42213f9

SHA1
bbe25a55e150745b8d1e574b1f4f5b941096fee6

SHA256
65ffe528822ab58f8f8dbb1a08ef5423f3f2b618f327d899aded3123ced9c614

SHA512
782f9d4486bc07c8d77094927caa4c442bb8c655753459735b7ea2ae1ef3eadb1a48073314a837eeb24403ac5fadce9d2ac20c3c27a53b78f3bd38e69db40297

Download Submit
C:\Windows\system\BEBKyCQ.exe

Filesize
1.9MB

MD5
697f2f3eb875c2c910c8d60a05d898ee

SHA1
e646b7a858a0a4aa1c6b9a7ca0daa5b644b15545

SHA256
03212ef6b13098e9ba17e03dcc470de079f21a30585156bfbdf1200d909982b8

SHA512
af102ef0a09c676649a3196f93d077aca6efb1cb504f9634883de277af600122a4f2d63eb87e6b72cb48e305dd6b0d861d040b064517c1a52f03562d0e093a97

Download Submit
C:\Windows\system\EboMWuA.exe

Filesize
1.9MB

MD5
eee4f57b2e6ad1bd9dbcdf2d26f95c9a

SHA1
bb6e1b1e0bf02e0a98f75daeb860141398f4efce

SHA256
06d788f352c6c80af2c44533c39ee397d8834c5bd42fc3d49d30149d1457bfad

SHA512
cf215697fe81679f72098f4a7a50f7875de9d9690551daf60a974f42fa49d75c841bc6f576b2777f9e0cd2e6d0b6bf06f91a70371a283d930d06fc62fdd55998

Download Submit
C:\Windows\system\GNDCJWf.exe

Filesize
1.9MB

MD5
4ef4de135cb4ab2ab513d2596c82dccd

SHA1
3132a8d8c8017e55a6813ccc613f5b303c5a5153

SHA256
c34584883504aa9ba2ef7a4937054d76e075a0006082f87fb3c2339591590949

SHA512
4093dbc26adaf03b8193a3f97da80ae19eaa7565baad3514ad724671caddd06b6381475c34ad86e9bb0e61e07796f0b68fe6d43794f7126398341264da096060

Download Submit
C:\Windows\system\GiHORnW.exe

Filesize
1.9MB

MD5
1898a2f20b7567f8b24c93b85f6ff55e

SHA1
fac167d335eb62ace27c97fa0bfca257c104fad6

SHA256
9153c2f9eed72a90e22cd90013ee4bd09b4aed25190975ab3f680aa0bb3ca2aa

SHA512
8478913302cd1ea5086e3e4174932773d4cdc6d96f293a131bfb6d38632de5f22ddbc8fd64f11083dceadb5dd78f5018d7ca5a652a859f08b3425c4bfe46aecf

Download Submit
C:\Windows\system\OGMtfAb.exe

Filesize
1.9MB

MD5
e39dd3da741c3136d1a202a39eeadc8d

SHA1
024863005df75829e2618b2e2f7b78800181a473

SHA256
723dffbf1de460eeefdbedc6e63511ed2cf5659cd9745c0aeb0bdaaf7ee89f0d

SHA512
eecd1d195f97f366c35f931ec676f3380fbb695afea11a46a019fce810779db3ab0fc9dee12704484d34d23319d8f410f796b99689c24223e3f449366eb2eda6

Download Submit
C:\Windows\system\PXMtBqj.exe

Filesize
1.9MB

MD5
85fb6ed04ed8b5cf736ccde443f92faa

SHA1
658f00189fb671af25961871ade37d4b65b97727

SHA256
19588bdc7c608abc76487ef269f7b71e640890d4bac1a9898c0bddca426bbace

SHA512
b1b9092f0bd61dafd4e35597da89cbc0e5950d7514ed2b720c0115819c3dbdd48340248e1a7ffaf2116e0c762cdb45149e90545740a9316456711a9f0c907710

Download Submit
C:\Windows\system\SzxFmJU.exe

Filesize
1.9MB

MD5
b1200ff4e9f4ee9dc9fb5b2513a70fca

SHA1
8be3cd9c5ef86cecb5a30bde42212d7b865009cc

SHA256
c89d3726603297f274372c84ffcd2779df7aa4e69d975bec08ec52b9f97d05e7

SHA512
196ca50234750981a3a0060c9b1ca33130b2d58d09eb635f77bb3a1e839b597f7f1fdea67ecc3fbfe35f5ab23f2fe15090c729d0bd3e0c26dbdb818a64ea7b14

Download Submit
C:\Windows\system\VZSgiNJ.exe

Filesize
1.9MB

MD5
703da153fce83fe2676ccb4254285534

SHA1
4ee3d228ce9fb34ccb4b04be7ac56d6b29214bb9

SHA256
f88fb565051436867b44958f9105e4c1b63cfbe5dd9fbb000820fc23c4bc82ab

SHA512
b60396a390652c77d3a55da8b44cd31037ebf471cba63603285ba60f23ddf2d11a349593272177f6de79f27c1aa2798642e4cd6ac3f8cf6a6fcfe70bf14c26a4

Download Submit
C:\Windows\system\XhrguaD.exe

Filesize
1.9MB

MD5
49bc84d176e1645927594c542a56a289

SHA1
c0de3d60a223b6aaee7de088baf6c4e4f903b3f1

SHA256
494e285061cadd71b322a7b762e497633104877f8df715ce63add07f33ababbb

SHA512
6e55485696b1dd357487406e16c490dd9b63f84c8e4c7768ee9cf11e27fd8979302eed93cb548439e692a65f6866aa742778f3636396657a7738e4c466a74f34

Download Submit
C:\Windows\system\YCuohAv.exe

Filesize
1.9MB

MD5
f3b3d0698bd3d0ed592bd97044dccadf

SHA1
04d4bc8ef64ee3590b26a1ce364e89aad6fc8003

SHA256
3a88880673371abd8830ff225fda656abdf225a3f0e914047098ada5ae8fee94

SHA512
7873d05e85ac1584e87719f52f10b8f92e39f43e0ec572c401c87c9d76cb43ac9069f30f236ded704080126ceb477d2586ca9c1335ea8ef7e4fb8f13a8be82c8

Download Submit
C:\Windows\system\ZMCvJsg.exe

Filesize
1.9MB

MD5
46ee7e85054639b8e3b12816b65639b9

SHA1
1db48f90aaf7bb21347385d4b4c7f338ed3d68a3

SHA256
5b3b00d9d7abec38e4499cb97bb4f0a624271f8034056bfa16c67b3708e1ad23

SHA512
912390ffd8edb4150a10c782ad4eda5972df0afa1cf055c8965d44e958d870bd64b532c103d5f29517622846ce79bfba18a4fd995903166b16b6870c8c0233bc

Download Submit
C:\Windows\system\ZZHWbHN.exe

Filesize
1.9MB

MD5
9928cfcf9de9ea1e9227aa841b98747c

SHA1
0e9e3648435037c880c82f6ce206dd4aa0a5637b

SHA256
8e15b6b693277a4204744d5d6f6651a5b5bb02e6c549d6d0a24838981f019d66

SHA512
c4d1d1e8e7dc2874f8197c2d6708c2ce4b1d852fc7a0b19cc29bcde9c13eb587930c4437bf83d582cb0e4cdbc227da5cab99661dd6e73737d0ab99185f59e330

Download Submit
C:\Windows\system\agOkDcK.exe

Filesize
1.9MB

MD5
aeadfd4679e464ed722de42b3656067f

SHA1
0916d5774298bd4e8d12a7720b9359f1c516b590

SHA256
5962ffcbde2faa686f1055ea6a67a0085ba980e8d0e497aca13eacf6c02e8890

SHA512
7e94e8ceea644aba22ae8342c2d2b53c6cc68104256a62a2874b90762b1125595f2f17f016069a803e6eb87e1e9a507d8e01019f48f8a533766ce93e10a8fccb

Download Submit
C:\Windows\system\bjzhpkF.exe

Filesize
1.9MB

MD5
a7e6ada206b16bb2e5e6b24e9cdc62e7

SHA1
896542f25e556033faf9348a215c565ff3fe5f0f

SHA256
4fc0cb2b562e691b0856376d044ae60cb4741ccc2805432cb938b9d9c7ab7a75

SHA512
e83d301db165660e2e5e73e730171bb217ff85665db0b9178f8dd18456237dc3c939e8913d99f3b0365fd3bd5cac0f9a9ddb76a3c688fd75e7372d599aad2c1f

Download Submit
C:\Windows\system\boCcHOy.exe

Filesize
1.9MB

MD5
2f58e38f5fe7a68e065733d7b918c5cf

SHA1
912e5baf471ce6a892fa8535ddf99b863e8a1f68

SHA256
6997755a90fc5a29cc5c0bba28c9b947c6d23363d6cf059d0d49abc9802f959b

SHA512
5bf6f5d4dc6020d074cd3bf3d57792f5692899a791e03fe275f138b83b4fcda9544c9188e2f608f903fa34abbf596343c05f2e10390f38279fb927ccc8c9e1b3

Download Submit
C:\Windows\system\cPDKVxP.exe

Filesize
1.9MB

MD5
0b07b574258b8a75f25caa2ef8f0f7cf

SHA1
c307228ce7a1011bde672c896e7a5a9ae57b1234

SHA256
2dced7279cc3fa5c28ab258d2419d1ba157be70aca69dac1dcceb9d9539ead3a

SHA512
40c50fad7403ae32a78f96ef788e356ff8bf174894c59403afc597aa62a428c91f24200402ad594e038724935f4c6160896193a7cf1a82ff733a7adb9c5a78bd

Download Submit
C:\Windows\system\exmtFqi.exe

Filesize
1.9MB

MD5
ddabf6d8c04f0875dc2d2a071f9ac856

SHA1
71611935c9753a9487778738285a9dc1ed79f423

SHA256
d913be3d572ec65c00b99e1fa7e150beaf8e3bb61d250269b7dfb4c90a3b4fc0

SHA512
49ef490a2b0fd1462a1c41bc4b1eee25513ae08fd3aecf874585687b12f056788bfaf445ba5396e386ac42e4fcea572b7bddb9720ed57202801797c1026b8ac3

Download Submit
C:\Windows\system\gknFuxk.exe

Filesize
1.9MB

MD5
a3ab710292840ef10e52b6033bdfafce

SHA1
42d94752c5d7c3d08cf4f6810aac570f49f1bd6d

SHA256
f0e6279e6a577e334eabb4bade9595a15996ffa745bf787e85f2376059635621

SHA512
d7777caa53cc33ee17740b484b55108c4ad6ecfff86cf50ed0f9ec1426342054ec6fc0deb0022b1130e6a6519d43b68b83db1e25124f94f0a751b6f433830e38

Download Submit
C:\Windows\system\hlkXceo.exe

Filesize
1.9MB

MD5
0f041cde1cb6d0b3a0269f6918f77ddf

SHA1
1779f53165de375856553d6cba7300ad59c64956

SHA256
1466757fe4738fd1eec1e766bc024f59c3bf7260f7192027cc516fd2d65bca8f

SHA512
5fd6cacd0ec29b50e3fe8072731e5a7d585887c28d8afdb7b3cb01dfa8edc923f6912b3735008cd5f693348edc295e871811412134101dab0a204a50636103bc

Download Submit
C:\Windows\system\nnWFNuh.exe

Filesize
1.9MB

MD5
13fc125583b45e2f02a731f21c5676cb

SHA1
a02ae0e2373c49b88040240e4ffec327ebe2e5a7

SHA256
5a018d5ff53e48c11d9261cc2014a6453c5257fba3439837ec2bc4b4f207d8e5

SHA512
b2334e7bd30716fe1b2c89d3ad7933622ed915dcafe1fcafbd0c4b187624201c5d98f819ec3a169f77172bbe0c7e0eeaed1001204e14ece65de7541cf9a23fe4

Download Submit
C:\Windows\system\qcCdWIv.exe

Filesize
1.9MB

MD5
63289979c77b9c0d5efc64c8c6ba0336

SHA1
76953ba0eb508c35a8cb128f16b7fc70ba396aa4

SHA256
392dc87d6b1e61cca4491e6b9d3fcda63be76e4c7e39086c6fa43afec75ee3bc

SHA512
7a4d6d566df267cf6f47cf687295a1855fd7cc578bea236103317606fc0a29f034a22ba9964e5208ead8b21fb1ff8e7600d983a37c394045cb0650ad94efb6da

Download Submit
C:\Windows\system\rCMJbbE.exe

Filesize
1.9MB

MD5
d818717fcf3186621b300cee15402c77

SHA1
6e974603574fa4c21ba255b84e399b4da6c46adc

SHA256
2ddfd0b8e05c4e489cc8ee9d960ae5aff3f7deece786338293ba57d758c1386e

SHA512
b454b4bf3dcc7128596a114ef71aa34fcd50c9b0d173c089cba7940926b581f0f7d22ad727cc5ef5dddfd919576b8d654817505d1d1d82808281d6947ce89e19

Download Submit
C:\Windows\system\twrltpG.exe

Filesize
1.9MB

MD5
fb346c1b4864be3ba9fb89c9556cdba1

SHA1
941cd7d1e3eb2d53097a588de79d363262020e08

SHA256
de72381b332982e3afd86ec3ccda3373532e03991d16018a4db2a0d69ff0f26a

SHA512
37d4faf223b0f74f40cec1b844b5e91c190cd6080e4c8ee0b025eb55f923dd2793b6030126e7d7c423105fd33f50fc3a77519f358ca268cb583eed7aa2d0c2fd

Download Submit
C:\Windows\system\xTGJrHe.exe

Filesize
1.9MB

MD5
01b51c478373236a9cea600a8edfdcf9

SHA1
63ea14a88902bd7b6722de0ff7032330b40aee42

SHA256
e640606528a05e54d71e284ddec4d5ccda52118d8273e74e279d7154eaeb22c5

SHA512
8634b26e58649e18107e0d2ac9e737a5069825ff9c929dd296d6f7f55a7a38d0e45c81512c64ec273558ba926fac7f2ac7b5a2e03533b6033d5edee249eedd57

Download Submit
C:\Windows\system\xrKBMYI.exe

Filesize
1.9MB

MD5
8a063fbebfca642ef5476e32f28ad8ef

SHA1
b350aad757db9e8e263403cea5faab6ca9297bdc

SHA256
db21c89f3286061dfbc39c12429cc2a39f6c5e716ed80e159a8dae525cc35143

SHA512
5f5c0a55b506649840b602711ef6693ef22e27a81fd2c9a65b0336f6d2bf8db89c918e078d279edc592ddb4cfee17b1825f3445c1bd6f980c8d8ef010aa27bf5

Download Submit
C:\Windows\system\yppeusG.exe

Filesize
1.9MB

MD5
58b9f74d190b5c6aca89da1af51b9ce2

SHA1
84cf814d09f5807a435ae3609827feee50418991

SHA256
c474a439c8ade91a843ebe48354f6e3730f19aacc32e9b4b144e50c219802e81

SHA512
25bf17795b39cd147fa2cc4b6852821e5c7ea70c9f274b80fcf62db5c0f29571f3d4e5881edd2844b9c413ae80f13332084ea20f759df1f6f9d187b8752e2c55

Download Submit
\Windows\system\IlPGaMV.exe

Filesize
1.9MB

MD5
078c37e89064dcc1f36522b1718ec30c

SHA1
c07cb9c16c6f89a46dfa83f58224e409d3709359

SHA256
4293ea6c2ca380a919d19b25f834bc21a82b552c6efae556f1eeedf71581ea02

SHA512
de5c56454f211f8d671cad315c74bcf2cb721016e5df77de117ac4e21df23ff186c29a265a6de67725349be0ad5708bc21f17b0c4a65e33fb7c69507c54f85d8

Download Submit
\Windows\system\fSFxHuq.exe

Filesize
1.9MB

MD5
08461e5e474cc520ecc36d083a6e0323

SHA1
eafc8335290328be2c9391bba2ad4e23afa1b86a

SHA256
50477516634d446b1867897d0d9921d369e56c4fb3998b6a3000718d30858f91

SHA512
47f512834583e4df6455620d7729f069bed0adb41a477e85ba60cd934ce6515ea6ca05f6a18fa18e62c4a13b6e08e61d05968d2f801baa8d8ae0acd8cadcd15b

Download Submit
\Windows\system\qjAafdm.exe

Filesize
1.9MB

MD5
12ff68ab4c01da30ec09c73cda167729

SHA1
e6fc8aac6aff6ba6532678147709bd1daeb5ab50

SHA256
8bb468b391dbbe61baea6837f142716482726d4760636c0fcb8b7fc645fc3d98

SHA512
02af27d6a77ebce81b3eac1a6c69b776fdace4aa2f97996793590efd94f5859a6a703a51409d251a3f343f8033563e0505eb71dc80cc08bc384d7cb388cca503

Download Submit
\Windows\system\tHzUdhf.exe

Filesize
1.9MB

MD5
bf2977862e18d4ac1175a9bf8f70848f

SHA1
31e54572e85dcba6d8d3e13f385d440f1522c5f8

SHA256
9ad386109ba1be7170fa96ff27c62755d30e40d484ede889826e532565467989

SHA512
4db725dcd1e221beb9f1186885fdeafb867991cd152f6fad688f89a41a4a63c867d2c8ae73a33a6e7bc6842cce4195c727fa6690c0c1e4673f4e85fbe490a8d5

Download Submit
\Windows\system\wpZXgtK.exe

Filesize
1.9MB

MD5
15e22da5cdb8fd806ba0cae3e91fd19c

SHA1
a70040529ac979cbe87546c0a438edbc87adc3e6

SHA256
06f3352e74086aceced6bfa41f793d4139614421fb7aa6a1bf849ce1ae44514e

SHA512
b4ccaf6f5e7b3db30a9a6446cc62f446d8a94eae3f6932f2c4118088c929bfa147e23d5480df6826ce2108b974eb2904f0b5f41621ec1077cf880e8683b1c137

Download Submit
memory/1776-50-0x000000001B3F0000-0x000000001B6D2000-memory.dmp

Filesize
2.9MB

Download
memory/1776-64-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/1776-51-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

Filesize
9.6MB

Download
memory/1776-52-0x00000000023B0000-0x0000000002430000-memory.dmp

Filesize
512KB

Download
memory/1776-85-0x00000000023B0000-0x0000000002430000-memory.dmp

Filesize
512KB

Download
memory/1776-53-0x000007FEF5790000-0x000007FEF612D000-memory.dmp

Filesize
9.6MB

Download
memory/1776-54-0x00000000023B0000-0x0000000002430000-memory.dmp

Filesize
512KB

Download
memory/2144-3901-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2144-13-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2228-72-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-3998-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-86-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2300-75-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-79-0x0000000002C60000-0x0000000003052000-memory.dmp

Filesize
3.9MB

Download
memory/2300-84-0x0000000002DA0000-0x0000000003192000-memory.dmp

Filesize
3.9MB

Download
memory/2300-77-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-88-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-8-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2300-2-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-21-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2300-73-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2300-70-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-78-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-3894-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-24-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2436-4004-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2504-3759-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-76-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-87-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2640-74-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-3779-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-83-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2924-68-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-4029-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download