xmrig | c17f350978933feee628392a1fc3821871b5b49e3cfec9e74741f4ce51f29340

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
Size

1.4MB
MD5

0d16ab84689e7c61079054b1c0f3e5e3
SHA1

5ac928daefac4845fea194e7bf84b959a3c06409
SHA256

c17f350978933feee628392a1fc3821871b5b49e3cfec9e74741f4ce51f29340
SHA512

7c1db50dd4876dbcb40d9d804c74abb87e455512efb813a8e022c623ecb99fd3fb3896233bdc73d7c1defc12b8f0639e8b813c956aa6bac88050640c421178b9
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwlZCA:Lz071uv4BPMkibTIA5CJS

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/3032-16-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2020-13-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/1860-124-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2152-122-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2488-120-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2548-118-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/2456-116-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2424-114-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2712-112-0x00000000032D0000-0x00000000036C2000-memory.dmp	xmrig
behavioral1/memory/2472-111-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2316-101-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2712-2121-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2648-4984-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2728-5022-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2472-5027-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2020	APqJSGd.exe
3032	OWausfX.exe
2648	VRYiUOv.exe
2728	XVIJpSI.exe
2316	lSYhnYA.exe
2472	GxgZmSK.exe
2424	GwNyBWv.exe
2456	uwrckmf.exe
2548	spwanzr.exe
2488	fWHhFaA.exe
2152	qbawOXi.exe
1860	kURMJgg.exe
2732	DkYtTpf.exe
2868	YkmKWLs.exe
2896	GvOdDnS.exe
2900	hVfYgPK.exe
1668	YATVlXk.exe
1944	JHywxMA.exe
2608	PSUUTtD.exe
1284	KOOZxkz.exe
1980	pRPBXAY.exe
2524	qJxsAfm.exe
1388	aqvkOvX.exe
840	TArCfUw.exe
2200	KEItqHN.exe
1304	uYSBXdt.exe
2108	gbiMtkM.exe
2760	oauqBCk.exe
1900	LhubNSd.exe
1548	nhoOWdd.exe
3020	soYFQPg.exe
1504	FhCnTxN.exe
344	JOLXTee.exe
760	unebvyA.exe
1848	axTEEOI.exe
2968	sTXFUHy.exe
2060	WQsjSjU.exe
904	qRjcoFs.exe
2508	WPXOdrJ.exe
1152	RSsRXmN.exe
1712	lkvRPvn.exe
2076	jLKjawD.exe
2780	zZVtxOR.exe
892	PlQtrEY.exe
2848	AFbCvkm.exe
1592	uFshogj.exe
2328	lZyfQXE.exe
2064	MuhIRlN.exe
2448	jBTeokl.exe
2504	LyqypXp.exe
2748	YYgFGXx.exe
1680	CmjxJLn.exe
848	voZcpHC.exe
2812	UKwjAXB.exe
632	TGiyZrq.exe
2308	zeRSWjn.exe
2980	hnOwUcw.exe
1500	bzjxXqe.exe
1040	NirtplF.exe
2944	mbzRREj.exe
1696	ytYUkVM.exe
2532	hvokUWN.exe
2584	hgfspaL.exe
2436	iKtNwru.exe

Loads dropped DLL 64 IoCs

pid	Process
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2712-0-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/files/0x000d000000012350-3.dat	upx
behavioral1/files/0x0037000000014712-8.dat	upx
behavioral1/memory/3032-16-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2020-13-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/files/0x0008000000014a9a-20.dat	upx
behavioral1/files/0x0007000000014b18-33.dat	upx
behavioral1/files/0x000e0000000054ab-34.dat	upx
behavioral1/files/0x0007000000014e71-42.dat	upx
behavioral1/files/0x0007000000015d20-52.dat	upx
behavioral1/files/0x0006000000015d42-56.dat	upx
behavioral1/files/0x0006000000015d56-64.dat	upx
behavioral1/files/0x0006000000015d6b-73.dat	upx
behavioral1/files/0x0006000000015d93-85.dat	upx
behavioral1/files/0x0006000000015d7f-77.dat	upx
behavioral1/files/0x0006000000015d87-79.dat	upx
behavioral1/files/0x0006000000015ecc-125.dat	upx
behavioral1/files/0x0006000000015fe5-143.dat	upx
behavioral1/files/0x000600000001630a-150.dat	upx
behavioral1/files/0x000600000001658a-157.dat	upx
behavioral1/files/0x0006000000016851-169.dat	upx
behavioral1/files/0x000600000001621e-176.dat	upx
behavioral1/files/0x0006000000016c44-189.dat	upx
behavioral1/files/0x0006000000016c5e-194.dat	upx
behavioral1/files/0x0006000000016adc-185.dat	upx
behavioral1/files/0x0006000000016616-183.dat	upx
behavioral1/files/0x00060000000164aa-181.dat	upx
behavioral1/files/0x003700000001471a-136.dat	upx
behavioral1/files/0x0006000000015f65-128.dat	upx
behavioral1/memory/1860-124-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2152-122-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2488-120-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2548-118-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/memory/2456-116-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2424-114-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2472-111-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2316-101-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2728-99-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x0006000000015e32-89.dat	upx
behavioral1/files/0x000600000001610f-144.dat	upx
behavioral1/files/0x0006000000015d5f-68.dat	upx
behavioral1/files/0x0006000000015d4e-60.dat	upx
behavioral1/files/0x0008000000015cff-49.dat	upx
behavioral1/files/0x0008000000014bbc-40.dat	upx
behavioral1/memory/2648-27-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2712-2121-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/2648-4984-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2728-5022-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2472-5027-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ACQveCp.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\EqIJkuM.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\odPnjaN.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\TvaRHcu.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\LPUxmPZ.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\dmOUhAW.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\qtlztuw.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\JTHELbl.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\FGKqtaO.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\BKoPrRk.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\CaAwsmY.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\sSgNTJx.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\dCqeLGU.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\iKEIBzA.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\BpMDbiZ.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\FAsQUdo.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\gIQejiv.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\KRzRIUk.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\yHZYxyQ.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\uMkhFzy.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\dXqmyTV.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\GcIEahf.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\BZhJSdF.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\JFvaQwI.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\bpfPmfn.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\YUHCTKm.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\URcLxFB.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\CyUCUpu.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\KudUmrw.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\UpOuPSd.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\oKzmoqx.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\jiotYaS.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\ZJvYdTB.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\AKCBCvB.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\XsZGBbR.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\FGwSCDj.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\Dbleefn.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\lAspjdF.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\rKudAbY.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\jPGgHsK.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\hokGrHe.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\zQxsGJj.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\niDTniO.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\UgOTBYz.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\qSHWLjN.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\whlejrG.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\NkLuiPz.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\DVChlnk.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\BrANJke.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\GPKFYno.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\XQCDGmS.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\rLjEktU.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\szBoUvy.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\YscdIFG.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\VcKLHmU.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\pIQSdIC.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\UlNwqxt.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\ySvdnyn.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\ivOoYjG.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\qaadrkx.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\AukAVWz.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\iQntMqA.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\JxtgsOK.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
File created	C:\Windows\System\UcrFCjj.exe	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2320	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
Token: SeDebugPrivilege	2320	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2320	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	29
PID 2712 wrote to memory of 2320	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	29
PID 2712 wrote to memory of 2320	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	29
PID 2712 wrote to memory of 2020	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	30
PID 2712 wrote to memory of 2020	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	30
PID 2712 wrote to memory of 2020	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	30
PID 2712 wrote to memory of 3032	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	31
PID 2712 wrote to memory of 3032	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	31
PID 2712 wrote to memory of 3032	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	31
PID 2712 wrote to memory of 2648	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	32
PID 2712 wrote to memory of 2648	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	32
PID 2712 wrote to memory of 2648	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	32
PID 2712 wrote to memory of 2728	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	33
PID 2712 wrote to memory of 2728	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	33
PID 2712 wrote to memory of 2728	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	33
PID 2712 wrote to memory of 2316	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	34
PID 2712 wrote to memory of 2316	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	34
PID 2712 wrote to memory of 2316	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	34
PID 2712 wrote to memory of 2472	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	35
PID 2712 wrote to memory of 2472	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	35
PID 2712 wrote to memory of 2472	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	35
PID 2712 wrote to memory of 2424	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	36
PID 2712 wrote to memory of 2424	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	36
PID 2712 wrote to memory of 2424	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	36
PID 2712 wrote to memory of 2456	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	37
PID 2712 wrote to memory of 2456	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	37
PID 2712 wrote to memory of 2456	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	37
PID 2712 wrote to memory of 2548	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	38
PID 2712 wrote to memory of 2548	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	38
PID 2712 wrote to memory of 2548	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	38
PID 2712 wrote to memory of 2488	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	39
PID 2712 wrote to memory of 2488	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	39
PID 2712 wrote to memory of 2488	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	39
PID 2712 wrote to memory of 2152	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	40
PID 2712 wrote to memory of 2152	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	40
PID 2712 wrote to memory of 2152	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	40
PID 2712 wrote to memory of 1860	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	41
PID 2712 wrote to memory of 1860	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	41
PID 2712 wrote to memory of 1860	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	41
PID 2712 wrote to memory of 2732	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	42
PID 2712 wrote to memory of 2732	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	42
PID 2712 wrote to memory of 2732	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	42
PID 2712 wrote to memory of 2868	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	43
PID 2712 wrote to memory of 2868	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	43
PID 2712 wrote to memory of 2868	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	43
PID 2712 wrote to memory of 2896	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	44
PID 2712 wrote to memory of 2896	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	44
PID 2712 wrote to memory of 2896	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	44
PID 2712 wrote to memory of 2900	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	45
PID 2712 wrote to memory of 2900	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	45
PID 2712 wrote to memory of 2900	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	45
PID 2712 wrote to memory of 1668	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	46
PID 2712 wrote to memory of 1668	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	46
PID 2712 wrote to memory of 1668	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	46
PID 2712 wrote to memory of 1944	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	47
PID 2712 wrote to memory of 1944	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	47
PID 2712 wrote to memory of 1944	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	47
PID 2712 wrote to memory of 2608	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	48
PID 2712 wrote to memory of 2608	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	48
PID 2712 wrote to memory of 2608	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	48
PID 2712 wrote to memory of 2200	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	49
PID 2712 wrote to memory of 2200	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	49
PID 2712 wrote to memory of 2200	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	49
PID 2712 wrote to memory of 1284	2712	0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d16ab84689e7c61079054b1c0f3e5e3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\System\APqJSGd.exe
  C:\Windows\System\APqJSGd.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\OWausfX.exe
  C:\Windows\System\OWausfX.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\VRYiUOv.exe
  C:\Windows\System\VRYiUOv.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\XVIJpSI.exe
  C:\Windows\System\XVIJpSI.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\lSYhnYA.exe
  C:\Windows\System\lSYhnYA.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\GxgZmSK.exe
  C:\Windows\System\GxgZmSK.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\GwNyBWv.exe
  C:\Windows\System\GwNyBWv.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\uwrckmf.exe
  C:\Windows\System\uwrckmf.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\spwanzr.exe
  C:\Windows\System\spwanzr.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\fWHhFaA.exe
  C:\Windows\System\fWHhFaA.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\qbawOXi.exe
  C:\Windows\System\qbawOXi.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\kURMJgg.exe
  C:\Windows\System\kURMJgg.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\DkYtTpf.exe
  C:\Windows\System\DkYtTpf.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\YkmKWLs.exe
  C:\Windows\System\YkmKWLs.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\GvOdDnS.exe
  C:\Windows\System\GvOdDnS.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\hVfYgPK.exe
  C:\Windows\System\hVfYgPK.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\YATVlXk.exe
  C:\Windows\System\YATVlXk.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\JHywxMA.exe
  C:\Windows\System\JHywxMA.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\PSUUTtD.exe
  C:\Windows\System\PSUUTtD.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\KEItqHN.exe
  C:\Windows\System\KEItqHN.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\KOOZxkz.exe
  C:\Windows\System\KOOZxkz.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\uYSBXdt.exe
  C:\Windows\System\uYSBXdt.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\pRPBXAY.exe
  C:\Windows\System\pRPBXAY.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\gbiMtkM.exe
  C:\Windows\System\gbiMtkM.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\qJxsAfm.exe
  C:\Windows\System\qJxsAfm.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\oauqBCk.exe
  C:\Windows\System\oauqBCk.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\aqvkOvX.exe
  C:\Windows\System\aqvkOvX.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\LhubNSd.exe
  C:\Windows\System\LhubNSd.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\TArCfUw.exe
  C:\Windows\System\TArCfUw.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\nhoOWdd.exe
  C:\Windows\System\nhoOWdd.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\soYFQPg.exe
  C:\Windows\System\soYFQPg.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\FhCnTxN.exe
  C:\Windows\System\FhCnTxN.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\JOLXTee.exe
  C:\Windows\System\JOLXTee.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\axTEEOI.exe
  C:\Windows\System\axTEEOI.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\unebvyA.exe
  C:\Windows\System\unebvyA.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\sTXFUHy.exe
  C:\Windows\System\sTXFUHy.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\WQsjSjU.exe
  C:\Windows\System\WQsjSjU.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\WPXOdrJ.exe
  C:\Windows\System\WPXOdrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\qRjcoFs.exe
  C:\Windows\System\qRjcoFs.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\RSsRXmN.exe
  C:\Windows\System\RSsRXmN.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\lkvRPvn.exe
  C:\Windows\System\lkvRPvn.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\CmjxJLn.exe
  C:\Windows\System\CmjxJLn.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\jLKjawD.exe
  C:\Windows\System\jLKjawD.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\hnOwUcw.exe
  C:\Windows\System\hnOwUcw.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\zZVtxOR.exe
  C:\Windows\System\zZVtxOR.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\bzjxXqe.exe
  C:\Windows\System\bzjxXqe.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\PlQtrEY.exe
  C:\Windows\System\PlQtrEY.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\NirtplF.exe
  C:\Windows\System\NirtplF.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\AFbCvkm.exe
  C:\Windows\System\AFbCvkm.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\mbzRREj.exe
  C:\Windows\System\mbzRREj.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\uFshogj.exe
  C:\Windows\System\uFshogj.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\ytYUkVM.exe
  C:\Windows\System\ytYUkVM.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\lZyfQXE.exe
  C:\Windows\System\lZyfQXE.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\hvokUWN.exe
  C:\Windows\System\hvokUWN.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\MuhIRlN.exe
  C:\Windows\System\MuhIRlN.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\hgfspaL.exe
  C:\Windows\System\hgfspaL.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\jBTeokl.exe
  C:\Windows\System\jBTeokl.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\iKtNwru.exe
  C:\Windows\System\iKtNwru.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\LyqypXp.exe
  C:\Windows\System\LyqypXp.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\UqBmsms.exe
  C:\Windows\System\UqBmsms.exe
  2⤵
  PID:2264
- C:\Windows\System\YYgFGXx.exe
  C:\Windows\System\YYgFGXx.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\FAIqZzA.exe
  C:\Windows\System\FAIqZzA.exe
  2⤵
  PID:2844
- C:\Windows\System\voZcpHC.exe
  C:\Windows\System\voZcpHC.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\eLKkQLR.exe
  C:\Windows\System\eLKkQLR.exe
  2⤵
  PID:1728
- C:\Windows\System\UKwjAXB.exe
  C:\Windows\System\UKwjAXB.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\pmegepZ.exe
  C:\Windows\System\pmegepZ.exe
  2⤵
  PID:1792
- C:\Windows\System\TGiyZrq.exe
  C:\Windows\System\TGiyZrq.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\SauvgFq.exe
  C:\Windows\System\SauvgFq.exe
  2⤵
  PID:2036
- C:\Windows\System\zeRSWjn.exe
  C:\Windows\System\zeRSWjn.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\gVZAQKC.exe
  C:\Windows\System\gVZAQKC.exe
  2⤵
  PID:2184
- C:\Windows\System\yZLDqHp.exe
  C:\Windows\System\yZLDqHp.exe
  2⤵
  PID:2276
- C:\Windows\System\LuULeSV.exe
  C:\Windows\System\LuULeSV.exe
  2⤵
  PID:1612
- C:\Windows\System\XzXGXaX.exe
  C:\Windows\System\XzXGXaX.exe
  2⤵
  PID:2236
- C:\Windows\System\pfKxBfP.exe
  C:\Windows\System\pfKxBfP.exe
  2⤵
  PID:672
- C:\Windows\System\WfLrElY.exe
  C:\Windows\System\WfLrElY.exe
  2⤵
  PID:2004
- C:\Windows\System\ehZlKfd.exe
  C:\Windows\System\ehZlKfd.exe
  2⤵
  PID:2348
- C:\Windows\System\CCDQqgh.exe
  C:\Windows\System\CCDQqgh.exe
  2⤵
  PID:844
- C:\Windows\System\QGoyhnq.exe
  C:\Windows\System\QGoyhnq.exe
  2⤵
  PID:1240
- C:\Windows\System\rJMuloS.exe
  C:\Windows\System\rJMuloS.exe
  2⤵
  PID:1220
- C:\Windows\System\qstphum.exe
  C:\Windows\System\qstphum.exe
  2⤵
  PID:2284
- C:\Windows\System\mLFOcnj.exe
  C:\Windows\System\mLFOcnj.exe
  2⤵
  PID:1692
- C:\Windows\System\VtVJGET.exe
  C:\Windows\System\VtVJGET.exe
  2⤵
  PID:2208
- C:\Windows\System\zDrpNmB.exe
  C:\Windows\System\zDrpNmB.exe
  2⤵
  PID:2784
- C:\Windows\System\dMRucVk.exe
  C:\Windows\System\dMRucVk.exe
  2⤵
  PID:2520
- C:\Windows\System\szVoOsa.exe
  C:\Windows\System\szVoOsa.exe
  2⤵
  PID:2964
- C:\Windows\System\XZIbiyo.exe
  C:\Windows\System\XZIbiyo.exe
  2⤵
  PID:2272
- C:\Windows\System\VUPVbEB.exe
  C:\Windows\System\VUPVbEB.exe
  2⤵
  PID:1272
- C:\Windows\System\JTtivJv.exe
  C:\Windows\System\JTtivJv.exe
  2⤵
  PID:2788
- C:\Windows\System\NJGwKpV.exe
  C:\Windows\System\NJGwKpV.exe
  2⤵
  PID:2128
- C:\Windows\System\PilelTo.exe
  C:\Windows\System\PilelTo.exe
  2⤵
  PID:1556
- C:\Windows\System\UMcfQMI.exe
  C:\Windows\System\UMcfQMI.exe
  2⤵
  PID:1960
- C:\Windows\System\AZwfwTK.exe
  C:\Windows\System\AZwfwTK.exe
  2⤵
  PID:2664
- C:\Windows\System\HjUEZyM.exe
  C:\Windows\System\HjUEZyM.exe
  2⤵
  PID:1940
- C:\Windows\System\zFbqLMU.exe
  C:\Windows\System\zFbqLMU.exe
  2⤵
  PID:2180
- C:\Windows\System\AEiNrRP.exe
  C:\Windows\System\AEiNrRP.exe
  2⤵
  PID:2168
- C:\Windows\System\qlWJmtN.exe
  C:\Windows\System\qlWJmtN.exe
  2⤵
  PID:2408
- C:\Windows\System\wtskkdy.exe
  C:\Windows\System\wtskkdy.exe
  2⤵
  PID:2672
- C:\Windows\System\NODOXmT.exe
  C:\Windows\System\NODOXmT.exe
  2⤵
  PID:2560
- C:\Windows\System\PBcrsRc.exe
  C:\Windows\System\PBcrsRc.exe
  2⤵
  PID:1440
- C:\Windows\System\egBBDvo.exe
  C:\Windows\System\egBBDvo.exe
  2⤵
  PID:1996
- C:\Windows\System\yELWbTe.exe
  C:\Windows\System\yELWbTe.exe
  2⤵
  PID:1796
- C:\Windows\System\jTzsHpt.exe
  C:\Windows\System\jTzsHpt.exe
  2⤵
  PID:688
- C:\Windows\System\HUiKHpj.exe
  C:\Windows\System\HUiKHpj.exe
  2⤵
  PID:1764
- C:\Windows\System\WlQURkI.exe
  C:\Windows\System\WlQURkI.exe
  2⤵
  PID:2864
- C:\Windows\System\oEYqkGR.exe
  C:\Windows\System\oEYqkGR.exe
  2⤵
  PID:2740
- C:\Windows\System\VCNvkNc.exe
  C:\Windows\System\VCNvkNc.exe
  2⤵
  PID:2044
- C:\Windows\System\wPFYmaF.exe
  C:\Windows\System\wPFYmaF.exe
  2⤵
  PID:1536
- C:\Windows\System\HabyLdj.exe
  C:\Windows\System\HabyLdj.exe
  2⤵
  PID:3068
- C:\Windows\System\twLpcAE.exe
  C:\Windows\System\twLpcAE.exe
  2⤵
  PID:2568
- C:\Windows\System\bjiyMaG.exe
  C:\Windows\System\bjiyMaG.exe
  2⤵
  PID:1616
- C:\Windows\System\vTxJtyv.exe
  C:\Windows\System\vTxJtyv.exe
  2⤵
  PID:2892
- C:\Windows\System\bMGoxYQ.exe
  C:\Windows\System\bMGoxYQ.exe
  2⤵
  PID:1252
- C:\Windows\System\UwAlCIR.exe
  C:\Windows\System\UwAlCIR.exe
  2⤵
  PID:332
- C:\Windows\System\JhmBsWL.exe
  C:\Windows\System\JhmBsWL.exe
  2⤵
  PID:2744
- C:\Windows\System\KvTKuzq.exe
  C:\Windows\System\KvTKuzq.exe
  2⤵
  PID:1596
- C:\Windows\System\MJgMSlb.exe
  C:\Windows\System\MJgMSlb.exe
  2⤵
  PID:3000
- C:\Windows\System\EBOMjXa.exe
  C:\Windows\System\EBOMjXa.exe
  2⤵
  PID:3028
- C:\Windows\System\UspZaBs.exe
  C:\Windows\System\UspZaBs.exe
  2⤵
  PID:764
- C:\Windows\System\Rnphmgh.exe
  C:\Windows\System\Rnphmgh.exe
  2⤵
  PID:2920
- C:\Windows\System\aaGyPyU.exe
  C:\Windows\System\aaGyPyU.exe
  2⤵
  PID:2440
- C:\Windows\System\urtarRu.exe
  C:\Windows\System\urtarRu.exe
  2⤵
  PID:2604
- C:\Windows\System\TmWHvYu.exe
  C:\Windows\System\TmWHvYu.exe
  2⤵
  PID:1280
- C:\Windows\System\iIZAmMN.exe
  C:\Windows\System\iIZAmMN.exe
  2⤵
  PID:1964
- C:\Windows\System\ecPHgWf.exe
  C:\Windows\System\ecPHgWf.exe
  2⤵
  PID:2432
- C:\Windows\System\jBVfoTB.exe
  C:\Windows\System\jBVfoTB.exe
  2⤵
  PID:552
- C:\Windows\System\RCBaPFk.exe
  C:\Windows\System\RCBaPFk.exe
  2⤵
  PID:2680
- C:\Windows\System\CAHOkbJ.exe
  C:\Windows\System\CAHOkbJ.exe
  2⤵
  PID:1772
- C:\Windows\System\oyXsyXw.exe
  C:\Windows\System\oyXsyXw.exe
  2⤵
  PID:2268
- C:\Windows\System\RprXMLV.exe
  C:\Windows\System\RprXMLV.exe
  2⤵
  PID:2632
- C:\Windows\System\cgONqUd.exe
  C:\Windows\System\cgONqUd.exe
  2⤵
  PID:3048
- C:\Windows\System\kpEyKcG.exe
  C:\Windows\System\kpEyKcG.exe
  2⤵
  PID:3036
- C:\Windows\System\ePPZbbU.exe
  C:\Windows\System\ePPZbbU.exe
  2⤵
  PID:2476
- C:\Windows\System\AdqidzA.exe
  C:\Windows\System\AdqidzA.exe
  2⤵
  PID:1544
- C:\Windows\System\rRMVxwD.exe
  C:\Windows\System\rRMVxwD.exe
  2⤵
  PID:548
- C:\Windows\System\sGXBTyf.exe
  C:\Windows\System\sGXBTyf.exe
  2⤵
  PID:1856
- C:\Windows\System\nfpythd.exe
  C:\Windows\System\nfpythd.exe
  2⤵
  PID:320
- C:\Windows\System\Dhhsyfi.exe
  C:\Windows\System\Dhhsyfi.exe
  2⤵
  PID:2444
- C:\Windows\System\ZXeUiGz.exe
  C:\Windows\System\ZXeUiGz.exe
  2⤵
  PID:1920
- C:\Windows\System\peUuaYh.exe
  C:\Windows\System\peUuaYh.exe
  2⤵
  PID:1644
- C:\Windows\System\QrIPXEW.exe
  C:\Windows\System\QrIPXEW.exe
  2⤵
  PID:2148
- C:\Windows\System\YrZfBNp.exe
  C:\Windows\System\YrZfBNp.exe
  2⤵
  PID:328
- C:\Windows\System\NFsgzmR.exe
  C:\Windows\System\NFsgzmR.exe
  2⤵
  PID:2660
- C:\Windows\System\GkEEqvt.exe
  C:\Windows\System\GkEEqvt.exe
  2⤵
  PID:3096
- C:\Windows\System\CKiuLps.exe
  C:\Windows\System\CKiuLps.exe
  2⤵
  PID:3112
- C:\Windows\System\asVwxwm.exe
  C:\Windows\System\asVwxwm.exe
  2⤵
  PID:3128
- C:\Windows\System\YREtBst.exe
  C:\Windows\System\YREtBst.exe
  2⤵
  PID:3152
- C:\Windows\System\vOPWAgp.exe
  C:\Windows\System\vOPWAgp.exe
  2⤵
  PID:3168
- C:\Windows\System\JMRORbn.exe
  C:\Windows\System\JMRORbn.exe
  2⤵
  PID:3184
- C:\Windows\System\FqLOUlE.exe
  C:\Windows\System\FqLOUlE.exe
  2⤵
  PID:3200
- C:\Windows\System\QqjmIyo.exe
  C:\Windows\System\QqjmIyo.exe
  2⤵
  PID:3216
- C:\Windows\System\mwIfmKz.exe
  C:\Windows\System\mwIfmKz.exe
  2⤵
  PID:3232
- C:\Windows\System\aJxgljF.exe
  C:\Windows\System\aJxgljF.exe
  2⤵
  PID:3248
- C:\Windows\System\khNBetx.exe
  C:\Windows\System\khNBetx.exe
  2⤵
  PID:3264
- C:\Windows\System\dpcRqxz.exe
  C:\Windows\System\dpcRqxz.exe
  2⤵
  PID:3280
- C:\Windows\System\gRFHnyv.exe
  C:\Windows\System\gRFHnyv.exe
  2⤵
  PID:3300
- C:\Windows\System\SEwlqLz.exe
  C:\Windows\System\SEwlqLz.exe
  2⤵
  PID:3316
- C:\Windows\System\xSmivsp.exe
  C:\Windows\System\xSmivsp.exe
  2⤵
  PID:3332
- C:\Windows\System\HiNTKKu.exe
  C:\Windows\System\HiNTKKu.exe
  2⤵
  PID:3348
- C:\Windows\System\xIHWBJl.exe
  C:\Windows\System\xIHWBJl.exe
  2⤵
  PID:3368
- C:\Windows\System\CHKAzVD.exe
  C:\Windows\System\CHKAzVD.exe
  2⤵
  PID:3384
- C:\Windows\System\XAanUam.exe
  C:\Windows\System\XAanUam.exe
  2⤵
  PID:3400
- C:\Windows\System\rKznLXs.exe
  C:\Windows\System\rKznLXs.exe
  2⤵
  PID:3416
- C:\Windows\System\saCTPAt.exe
  C:\Windows\System\saCTPAt.exe
  2⤵
  PID:3432
- C:\Windows\System\YFljhvq.exe
  C:\Windows\System\YFljhvq.exe
  2⤵
  PID:3452
- C:\Windows\System\hROEhri.exe
  C:\Windows\System\hROEhri.exe
  2⤵
  PID:3468
- C:\Windows\System\BsNEMMy.exe
  C:\Windows\System\BsNEMMy.exe
  2⤵
  PID:3484
- C:\Windows\System\xoPxywX.exe
  C:\Windows\System\xoPxywX.exe
  2⤵
  PID:3500
- C:\Windows\System\SIZXdyx.exe
  C:\Windows\System\SIZXdyx.exe
  2⤵
  PID:3516
- C:\Windows\System\BITBpnq.exe
  C:\Windows\System\BITBpnq.exe
  2⤵
  PID:3532
- C:\Windows\System\faWUbgn.exe
  C:\Windows\System\faWUbgn.exe
  2⤵
  PID:3548
- C:\Windows\System\QcglDtY.exe
  C:\Windows\System\QcglDtY.exe
  2⤵
  PID:3564
- C:\Windows\System\eaHRhJe.exe
  C:\Windows\System\eaHRhJe.exe
  2⤵
  PID:3580
- C:\Windows\System\OaWzQWF.exe
  C:\Windows\System\OaWzQWF.exe
  2⤵
  PID:3600
- C:\Windows\System\dMyATAP.exe
  C:\Windows\System\dMyATAP.exe
  2⤵
  PID:3616
- C:\Windows\System\kyQupGC.exe
  C:\Windows\System\kyQupGC.exe
  2⤵
  PID:3632
- C:\Windows\System\tuWqRkl.exe
  C:\Windows\System\tuWqRkl.exe
  2⤵
  PID:3648
- C:\Windows\System\aNPWHrc.exe
  C:\Windows\System\aNPWHrc.exe
  2⤵
  PID:3664
- C:\Windows\System\oDtpHtJ.exe
  C:\Windows\System\oDtpHtJ.exe
  2⤵
  PID:3680
- C:\Windows\System\OTSimrH.exe
  C:\Windows\System\OTSimrH.exe
  2⤵
  PID:3932
- C:\Windows\System\PZnLTAi.exe
  C:\Windows\System\PZnLTAi.exe
  2⤵
  PID:3948
- C:\Windows\System\zkzAgxX.exe
  C:\Windows\System\zkzAgxX.exe
  2⤵
  PID:3964
- C:\Windows\System\kibPvKH.exe
  C:\Windows\System\kibPvKH.exe
  2⤵
  PID:3980
- C:\Windows\System\iFoseWR.exe
  C:\Windows\System\iFoseWR.exe
  2⤵
  PID:3996
- C:\Windows\System\jembeau.exe
  C:\Windows\System\jembeau.exe
  2⤵
  PID:4016
- C:\Windows\System\uOhQRJw.exe
  C:\Windows\System\uOhQRJw.exe
  2⤵
  PID:4032
- C:\Windows\System\KsUUPug.exe
  C:\Windows\System\KsUUPug.exe
  2⤵
  PID:4052
- C:\Windows\System\MsRhPSD.exe
  C:\Windows\System\MsRhPSD.exe
  2⤵
  PID:4088
- C:\Windows\System\IWQBcFO.exe
  C:\Windows\System\IWQBcFO.exe
  2⤵
  PID:2000
- C:\Windows\System\JRfdPYc.exe
  C:\Windows\System\JRfdPYc.exe
  2⤵
  PID:2572
- C:\Windows\System\hxroZON.exe
  C:\Windows\System\hxroZON.exe
  2⤵
  PID:1916
- C:\Windows\System\xICqFNT.exe
  C:\Windows\System\xICqFNT.exe
  2⤵
  PID:1188
- C:\Windows\System\RgJkRUC.exe
  C:\Windows\System\RgJkRUC.exe
  2⤵
  PID:3056
- C:\Windows\System\HwlgsCB.exe
  C:\Windows\System\HwlgsCB.exe
  2⤵
  PID:1332
- C:\Windows\System\JhLyjPD.exe
  C:\Windows\System\JhLyjPD.exe
  2⤵
  PID:2928
- C:\Windows\System\sbnNdat.exe
  C:\Windows\System\sbnNdat.exe
  2⤵
  PID:2052
- C:\Windows\System\ssyWcLL.exe
  C:\Windows\System\ssyWcLL.exe
  2⤵
  PID:3044
- C:\Windows\System\RibqOfL.exe
  C:\Windows\System\RibqOfL.exe
  2⤵
  PID:2984
- C:\Windows\System\jGhYeRT.exe
  C:\Windows\System\jGhYeRT.exe
  2⤵
  PID:336
- C:\Windows\System\TcJGHYt.exe
  C:\Windows\System\TcJGHYt.exe
  2⤵
  PID:3088
- C:\Windows\System\WzykBmv.exe
  C:\Windows\System\WzykBmv.exe
  2⤵
  PID:472
- C:\Windows\System\woFMEwu.exe
  C:\Windows\System\woFMEwu.exe
  2⤵
  PID:3104
- C:\Windows\System\NaJfAFp.exe
  C:\Windows\System\NaJfAFp.exe
  2⤵
  PID:3228
- C:\Windows\System\OHdBKfw.exe
  C:\Windows\System\OHdBKfw.exe
  2⤵
  PID:3324
- C:\Windows\System\UJIrSTr.exe
  C:\Windows\System\UJIrSTr.exe
  2⤵
  PID:3392
- C:\Windows\System\hyAyiVn.exe
  C:\Windows\System\hyAyiVn.exe
  2⤵
  PID:3492
- C:\Windows\System\fEqzoYQ.exe
  C:\Windows\System\fEqzoYQ.exe
  2⤵
  PID:3628
- C:\Windows\System\FXCAuho.exe
  C:\Windows\System\FXCAuho.exe
  2⤵
  PID:3180
- C:\Windows\System\RbYayZc.exe
  C:\Windows\System\RbYayZc.exe
  2⤵
  PID:3272
- C:\Windows\System\yEjUCdG.exe
  C:\Windows\System\yEjUCdG.exe
  2⤵
  PID:3308
- C:\Windows\System\GMvVtuc.exe
  C:\Windows\System\GMvVtuc.exe
  2⤵
  PID:3380
- C:\Windows\System\GwOGsez.exe
  C:\Windows\System\GwOGsez.exe
  2⤵
  PID:3444
- C:\Windows\System\vomTWDm.exe
  C:\Windows\System\vomTWDm.exe
  2⤵
  PID:3508
- C:\Windows\System\xkKwLPc.exe
  C:\Windows\System\xkKwLPc.exe
  2⤵
  PID:3576
- C:\Windows\System\CAFnBln.exe
  C:\Windows\System\CAFnBln.exe
  2⤵
  PID:3672
- C:\Windows\System\gMkfsnx.exe
  C:\Windows\System\gMkfsnx.exe
  2⤵
  PID:3640
- C:\Windows\System\TqZNBOU.exe
  C:\Windows\System\TqZNBOU.exe
  2⤵
  PID:1812
- C:\Windows\System\YSXEqYA.exe
  C:\Windows\System\YSXEqYA.exe
  2⤵
  PID:3328
- C:\Windows\System\iKEIBzA.exe
  C:\Windows\System\iKEIBzA.exe
  2⤵
  PID:3528
- C:\Windows\System\QxvpHJR.exe
  C:\Windows\System\QxvpHJR.exe
  2⤵
  PID:3800
- C:\Windows\System\RxaUjFc.exe
  C:\Windows\System\RxaUjFc.exe
  2⤵
  PID:3828
- C:\Windows\System\rqIbfXd.exe
  C:\Windows\System\rqIbfXd.exe
  2⤵
  PID:3844
- C:\Windows\System\wTwWauN.exe
  C:\Windows\System\wTwWauN.exe
  2⤵
  PID:3860
- C:\Windows\System\zQxsGJj.exe
  C:\Windows\System\zQxsGJj.exe
  2⤵
  PID:3880
- C:\Windows\System\EtxOwGo.exe
  C:\Windows\System\EtxOwGo.exe
  2⤵
  PID:3924
- C:\Windows\System\gAfXkyi.exe
  C:\Windows\System\gAfXkyi.exe
  2⤵
  PID:3928
- C:\Windows\System\AZAsYYH.exe
  C:\Windows\System\AZAsYYH.exe
  2⤵
  PID:3976
- C:\Windows\System\sxhaaZJ.exe
  C:\Windows\System\sxhaaZJ.exe
  2⤵
  PID:4040
- C:\Windows\System\EDbKHwJ.exe
  C:\Windows\System\EDbKHwJ.exe
  2⤵
  PID:4060
- C:\Windows\System\TCVqEMw.exe
  C:\Windows\System\TCVqEMw.exe
  2⤵
  PID:4072
- C:\Windows\System\TZJZXfu.exe
  C:\Windows\System\TZJZXfu.exe
  2⤵
  PID:4084
- C:\Windows\System\NoWucdL.exe
  C:\Windows\System\NoWucdL.exe
  2⤵
  PID:2084
- C:\Windows\System\xIeFqtc.exe
  C:\Windows\System\xIeFqtc.exe
  2⤵
  PID:3140
- C:\Windows\System\OKLpIys.exe
  C:\Windows\System\OKLpIys.exe
  2⤵
  PID:3440
- C:\Windows\System\YEYVkXZ.exe
  C:\Windows\System\YEYVkXZ.exe
  2⤵
  PID:3256
- C:\Windows\System\PVgmKBC.exe
  C:\Windows\System\PVgmKBC.exe
  2⤵
  PID:3700
- C:\Windows\System\CTcaqIx.exe
  C:\Windows\System\CTcaqIx.exe
  2⤵
  PID:2580
- C:\Windows\System\rvECNCJ.exe
  C:\Windows\System\rvECNCJ.exe
  2⤵
  PID:3212
- C:\Windows\System\HVWYSBc.exe
  C:\Windows\System\HVWYSBc.exe
  2⤵
  PID:1480
- C:\Windows\System\quaxxpq.exe
  C:\Windows\System\quaxxpq.exe
  2⤵
  PID:3124
- C:\Windows\System\FJGoDok.exe
  C:\Windows\System\FJGoDok.exe
  2⤵
  PID:3624
- C:\Windows\System\euJtbhg.exe
  C:\Windows\System\euJtbhg.exe
  2⤵
  PID:3476
- C:\Windows\System\OjVhwtG.exe
  C:\Windows\System\OjVhwtG.exe
  2⤵
  PID:3424
- C:\Windows\System\AaWKfkG.exe
  C:\Windows\System\AaWKfkG.exe
  2⤵
  PID:3296
- C:\Windows\System\zyjavFG.exe
  C:\Windows\System\zyjavFG.exe
  2⤵
  PID:3740
- C:\Windows\System\wxInJrm.exe
  C:\Windows\System\wxInJrm.exe
  2⤵
  PID:3748
- C:\Windows\System\xUIyUeH.exe
  C:\Windows\System\xUIyUeH.exe
  2⤵
  PID:3596
- C:\Windows\System\RApgGKx.exe
  C:\Windows\System\RApgGKx.exe
  2⤵
  PID:3764
- C:\Windows\System\CYvImDH.exe
  C:\Windows\System\CYvImDH.exe
  2⤵
  PID:3792
- C:\Windows\System\DRTkaHu.exe
  C:\Windows\System\DRTkaHu.exe
  2⤵
  PID:3784
- C:\Windows\System\BkVtQMs.exe
  C:\Windows\System\BkVtQMs.exe
  2⤵
  PID:3864
- C:\Windows\System\FDYhuhU.exe
  C:\Windows\System\FDYhuhU.exe
  2⤵
  PID:3876
- C:\Windows\System\IJQubrZ.exe
  C:\Windows\System\IJQubrZ.exe
  2⤵
  PID:3960
- C:\Windows\System\vzYunRR.exe
  C:\Windows\System\vzYunRR.exe
  2⤵
  PID:1576
- C:\Windows\System\jtEMFii.exe
  C:\Windows\System\jtEMFii.exe
  2⤵
  PID:4008
- C:\Windows\System\eVsvaGJ.exe
  C:\Windows\System\eVsvaGJ.exe
  2⤵
  PID:3956
- C:\Windows\System\GhfkBZd.exe
  C:\Windows\System\GhfkBZd.exe
  2⤵
  PID:2880
- C:\Windows\System\bwZQzjy.exe
  C:\Windows\System\bwZQzjy.exe
  2⤵
  PID:3460
- C:\Windows\System\ShXLAPr.exe
  C:\Windows\System\ShXLAPr.exe
  2⤵
  PID:1988
- C:\Windows\System\HktUZAu.exe
  C:\Windows\System\HktUZAu.exe
  2⤵
  PID:2500
- C:\Windows\System\iuPchGJ.exe
  C:\Windows\System\iuPchGJ.exe
  2⤵
  PID:2136
- C:\Windows\System\USgKMsk.exe
  C:\Windows\System\USgKMsk.exe
  2⤵
  PID:2564
- C:\Windows\System\VcIElpj.exe
  C:\Windows\System\VcIElpj.exe
  2⤵
  PID:1316
- C:\Windows\System\vbdTfxb.exe
  C:\Windows\System\vbdTfxb.exe
  2⤵
  PID:3364
- C:\Windows\System\NBzuPPH.exe
  C:\Windows\System\NBzuPPH.exe
  2⤵
  PID:3196
- C:\Windows\System\XcmVFmy.exe
  C:\Windows\System\XcmVFmy.exe
  2⤵
  PID:1620
- C:\Windows\System\AHdGvMm.exe
  C:\Windows\System\AHdGvMm.exe
  2⤵
  PID:3736
- C:\Windows\System\jTfcjbE.exe
  C:\Windows\System\jTfcjbE.exe
  2⤵
  PID:1432
- C:\Windows\System\pMfVMdI.exe
  C:\Windows\System\pMfVMdI.exe
  2⤵
  PID:3572
- C:\Windows\System\poLovHL.exe
  C:\Windows\System\poLovHL.exe
  2⤵
  PID:3588
- C:\Windows\System\GwSwFIK.exe
  C:\Windows\System\GwSwFIK.exe
  2⤵
  PID:2384
- C:\Windows\System\GbLuSpP.exe
  C:\Windows\System\GbLuSpP.exe
  2⤵
  PID:3820
- C:\Windows\System\vOWZHNC.exe
  C:\Windows\System\vOWZHNC.exe
  2⤵
  PID:3840
- C:\Windows\System\kGwRaoR.exe
  C:\Windows\System\kGwRaoR.exe
  2⤵
  PID:2776
- C:\Windows\System\TFykHYq.exe
  C:\Windows\System\TFykHYq.exe
  2⤵
  PID:1912
- C:\Windows\System\EYauBBE.exe
  C:\Windows\System\EYauBBE.exe
  2⤵
  PID:2720
- C:\Windows\System\uuWOdWe.exe
  C:\Windows\System\uuWOdWe.exe
  2⤵
  PID:3412
- C:\Windows\System\tQZOrFu.exe
  C:\Windows\System\tQZOrFu.exe
  2⤵
  PID:3836
- C:\Windows\System\KPERxeD.exe
  C:\Windows\System\KPERxeD.exe
  2⤵
  PID:3560
- C:\Windows\System\MtCoFbT.exe
  C:\Windows\System\MtCoFbT.exe
  2⤵
  PID:1684
- C:\Windows\System\eiqKONm.exe
  C:\Windows\System\eiqKONm.exe
  2⤵
  PID:1528
- C:\Windows\System\ekilNqo.exe
  C:\Windows\System\ekilNqo.exe
  2⤵
  PID:3376
- C:\Windows\System\TmfXEuH.exe
  C:\Windows\System\TmfXEuH.exe
  2⤵
  PID:3728
- C:\Windows\System\anUwUoY.exe
  C:\Windows\System\anUwUoY.exe
  2⤵
  PID:3752
- C:\Windows\System\RqadnWl.exe
  C:\Windows\System\RqadnWl.exe
  2⤵
  PID:1748
- C:\Windows\System\kSposDz.exe
  C:\Windows\System\kSposDz.exe
  2⤵
  PID:4024
- C:\Windows\System\LlyqotI.exe
  C:\Windows\System\LlyqotI.exe
  2⤵
  PID:4068
- C:\Windows\System\KxyMajZ.exe
  C:\Windows\System\KxyMajZ.exe
  2⤵
  PID:2576
- C:\Windows\System\akdzrMm.exe
  C:\Windows\System\akdzrMm.exe
  2⤵
  PID:3776
- C:\Windows\System\WJedzNP.exe
  C:\Windows\System\WJedzNP.exe
  2⤵
  PID:3744
- C:\Windows\System\UmMwbOM.exe
  C:\Windows\System\UmMwbOM.exe
  2⤵
  PID:3312
- C:\Windows\System\XzPEbRX.exe
  C:\Windows\System\XzPEbRX.exe
  2⤵
  PID:3824
- C:\Windows\System\xKLkTtT.exe
  C:\Windows\System\xKLkTtT.exe
  2⤵
  PID:3816
- C:\Windows\System\QhcLJhc.exe
  C:\Windows\System\QhcLJhc.exe
  2⤵
  PID:1424
- C:\Windows\System\PefEOUz.exe
  C:\Windows\System\PefEOUz.exe
  2⤵
  PID:3988
- C:\Windows\System\ZRjFpVg.exe
  C:\Windows\System\ZRjFpVg.exe
  2⤵
  PID:2908
- C:\Windows\System\bckXsUV.exe
  C:\Windows\System\bckXsUV.exe
  2⤵
  PID:1420
- C:\Windows\System\BTuTHsy.exe
  C:\Windows\System\BTuTHsy.exe
  2⤵
  PID:3872
- C:\Windows\System\kARKOTZ.exe
  C:\Windows\System\kARKOTZ.exe
  2⤵
  PID:2924
- C:\Windows\System\GEDLpxy.exe
  C:\Windows\System\GEDLpxy.exe
  2⤵
  PID:2012
- C:\Windows\System\okIQKek.exe
  C:\Windows\System\okIQKek.exe
  2⤵
  PID:3780
- C:\Windows\System\TSrgIhm.exe
  C:\Windows\System\TSrgIhm.exe
  2⤵
  PID:2716
- C:\Windows\System\PbrScRs.exe
  C:\Windows\System\PbrScRs.exe
  2⤵
  PID:3972
- C:\Windows\System\mvFaMjl.exe
  C:\Windows\System\mvFaMjl.exe
  2⤵
  PID:2032
- C:\Windows\System\loGyaZp.exe
  C:\Windows\System\loGyaZp.exe
  2⤵
  PID:3804
- C:\Windows\System\qkIVaxz.exe
  C:\Windows\System\qkIVaxz.exe
  2⤵
  PID:4108
- C:\Windows\System\DiggWNU.exe
  C:\Windows\System\DiggWNU.exe
  2⤵
  PID:4132
- C:\Windows\System\OkidQJU.exe
  C:\Windows\System\OkidQJU.exe
  2⤵
  PID:4152
- C:\Windows\System\YnywqJF.exe
  C:\Windows\System\YnywqJF.exe
  2⤵
  PID:4168
- C:\Windows\System\FJtXUxD.exe
  C:\Windows\System\FJtXUxD.exe
  2⤵
  PID:4188
- C:\Windows\System\PbCMbJW.exe
  C:\Windows\System\PbCMbJW.exe
  2⤵
  PID:4208
- C:\Windows\System\lHgSMFR.exe
  C:\Windows\System\lHgSMFR.exe
  2⤵
  PID:4224
- C:\Windows\System\pBLJnZx.exe
  C:\Windows\System\pBLJnZx.exe
  2⤵
  PID:4244
- C:\Windows\System\ZhTmHgQ.exe
  C:\Windows\System\ZhTmHgQ.exe
  2⤵
  PID:4268
- C:\Windows\System\LIHxWrG.exe
  C:\Windows\System\LIHxWrG.exe
  2⤵
  PID:4288
- C:\Windows\System\hRjtONa.exe
  C:\Windows\System\hRjtONa.exe
  2⤵
  PID:4308
- C:\Windows\System\soNTYXB.exe
  C:\Windows\System\soNTYXB.exe
  2⤵
  PID:4328
- C:\Windows\System\nsCrRXn.exe
  C:\Windows\System\nsCrRXn.exe
  2⤵
  PID:4352
- C:\Windows\System\aNfdBIz.exe
  C:\Windows\System\aNfdBIz.exe
  2⤵
  PID:4368
- C:\Windows\System\rSUmKpE.exe
  C:\Windows\System\rSUmKpE.exe
  2⤵
  PID:4384
- C:\Windows\System\tUhoWHn.exe
  C:\Windows\System\tUhoWHn.exe
  2⤵
  PID:4404
- C:\Windows\System\HlrwybS.exe
  C:\Windows\System\HlrwybS.exe
  2⤵
  PID:4420
- C:\Windows\System\RrjrDzB.exe
  C:\Windows\System\RrjrDzB.exe
  2⤵
  PID:4444
- C:\Windows\System\qzUGekp.exe
  C:\Windows\System\qzUGekp.exe
  2⤵
  PID:4464
- C:\Windows\System\GxeYtgn.exe
  C:\Windows\System\GxeYtgn.exe
  2⤵
  PID:4484
- C:\Windows\System\foxRLug.exe
  C:\Windows\System\foxRLug.exe
  2⤵
  PID:4508
- C:\Windows\System\LqhtLfg.exe
  C:\Windows\System\LqhtLfg.exe
  2⤵
  PID:4524
- C:\Windows\System\kOQvhZt.exe
  C:\Windows\System\kOQvhZt.exe
  2⤵
  PID:4540
- C:\Windows\System\ylwwpJp.exe
  C:\Windows\System\ylwwpJp.exe
  2⤵
  PID:4556
- C:\Windows\System\isejSIx.exe
  C:\Windows\System\isejSIx.exe
  2⤵
  PID:4604
- C:\Windows\System\lvdUIhF.exe
  C:\Windows\System\lvdUIhF.exe
  2⤵
  PID:4620
- C:\Windows\System\fhwatjj.exe
  C:\Windows\System\fhwatjj.exe
  2⤵
  PID:4636
- C:\Windows\System\jQIgWeu.exe
  C:\Windows\System\jQIgWeu.exe
  2⤵
  PID:4652
- C:\Windows\System\EMuSyFm.exe
  C:\Windows\System\EMuSyFm.exe
  2⤵
  PID:4668
- C:\Windows\System\LgwrIHN.exe
  C:\Windows\System\LgwrIHN.exe
  2⤵
  PID:4684
- C:\Windows\System\owlNkkL.exe
  C:\Windows\System\owlNkkL.exe
  2⤵
  PID:4700
- C:\Windows\System\ogcdkiu.exe
  C:\Windows\System\ogcdkiu.exe
  2⤵
  PID:4716
- C:\Windows\System\nMKlVtR.exe
  C:\Windows\System\nMKlVtR.exe
  2⤵
  PID:4732
- C:\Windows\System\wpqkxeS.exe
  C:\Windows\System\wpqkxeS.exe
  2⤵
  PID:4748
- C:\Windows\System\ZrWNksG.exe
  C:\Windows\System\ZrWNksG.exe
  2⤵
  PID:4764
- C:\Windows\System\yIsOsbF.exe
  C:\Windows\System\yIsOsbF.exe
  2⤵
  PID:4780
- C:\Windows\System\bLEPAoS.exe
  C:\Windows\System\bLEPAoS.exe
  2⤵
  PID:4800
- C:\Windows\System\vuuGweS.exe
  C:\Windows\System\vuuGweS.exe
  2⤵
  PID:4816
- C:\Windows\System\QqmjBtq.exe
  C:\Windows\System\QqmjBtq.exe
  2⤵
  PID:4832
- C:\Windows\System\QBSuzhe.exe
  C:\Windows\System\QBSuzhe.exe
  2⤵
  PID:4848
- C:\Windows\System\JaTfbmo.exe
  C:\Windows\System\JaTfbmo.exe
  2⤵
  PID:4864
- C:\Windows\System\jNPxZBd.exe
  C:\Windows\System\jNPxZBd.exe
  2⤵
  PID:4884
- C:\Windows\System\EpZeyrm.exe
  C:\Windows\System\EpZeyrm.exe
  2⤵
  PID:4900
- C:\Windows\System\ywUsaBz.exe
  C:\Windows\System\ywUsaBz.exe
  2⤵
  PID:4916
- C:\Windows\System\UcrFCjj.exe
  C:\Windows\System\UcrFCjj.exe
  2⤵
  PID:4932
- C:\Windows\System\OoqsleT.exe
  C:\Windows\System\OoqsleT.exe
  2⤵
  PID:4948
- C:\Windows\System\iLtyJkc.exe
  C:\Windows\System\iLtyJkc.exe
  2⤵
  PID:4964
- C:\Windows\System\PDBBSmX.exe
  C:\Windows\System\PDBBSmX.exe
  2⤵
  PID:5072
- C:\Windows\System\NebNQqM.exe
  C:\Windows\System\NebNQqM.exe
  2⤵
  PID:5088
- C:\Windows\System\zNZAShX.exe
  C:\Windows\System\zNZAShX.exe
  2⤵
  PID:5108
- C:\Windows\System\NUSTULX.exe
  C:\Windows\System\NUSTULX.exe
  2⤵
  PID:4116
- C:\Windows\System\PphCTYu.exe
  C:\Windows\System\PphCTYu.exe
  2⤵
  PID:4148
- C:\Windows\System\wbvUqrj.exe
  C:\Windows\System\wbvUqrj.exe
  2⤵
  PID:4256
- C:\Windows\System\YxDcorf.exe
  C:\Windows\System\YxDcorf.exe
  2⤵
  PID:4280
- C:\Windows\System\HHjZgMg.exe
  C:\Windows\System\HHjZgMg.exe
  2⤵
  PID:4296
- C:\Windows\System\ACVATZQ.exe
  C:\Windows\System\ACVATZQ.exe
  2⤵
  PID:4320
- C:\Windows\System\NebKBZo.exe
  C:\Windows\System\NebKBZo.exe
  2⤵
  PID:4348
- C:\Windows\System\LknOtMe.exe
  C:\Windows\System\LknOtMe.exe
  2⤵
  PID:4380
- C:\Windows\System\AyenaaA.exe
  C:\Windows\System\AyenaaA.exe
  2⤵
  PID:4400
- C:\Windows\System\auGQxic.exe
  C:\Windows\System\auGQxic.exe
  2⤵
  PID:4440
- C:\Windows\System\KQOuTSO.exe
  C:\Windows\System\KQOuTSO.exe
  2⤵
  PID:4456
- C:\Windows\System\YKuCJPp.exe
  C:\Windows\System\YKuCJPp.exe
  2⤵
  PID:4500
- C:\Windows\System\KEisOzR.exe
  C:\Windows\System\KEisOzR.exe
  2⤵
  PID:4516
- C:\Windows\System\MBSvWyU.exe
  C:\Windows\System\MBSvWyU.exe
  2⤵
  PID:4564
- C:\Windows\System\nWubNQv.exe
  C:\Windows\System\nWubNQv.exe
  2⤵
  PID:4576
- C:\Windows\System\jvYXcKB.exe
  C:\Windows\System\jvYXcKB.exe
  2⤵
  PID:4592
- C:\Windows\System\nYdJjaP.exe
  C:\Windows\System\nYdJjaP.exe
  2⤵
  PID:4760
- C:\Windows\System\OaPXokx.exe
  C:\Windows\System\OaPXokx.exe
  2⤵
  PID:4824
- C:\Windows\System\NXCGHAG.exe
  C:\Windows\System\NXCGHAG.exe
  2⤵
  PID:4644
- C:\Windows\System\uHHveOi.exe
  C:\Windows\System\uHHveOi.exe
  2⤵
  PID:4812
- C:\Windows\System\pzcWymt.exe
  C:\Windows\System\pzcWymt.exe
  2⤵
  PID:4676
- C:\Windows\System\jRzqWPe.exe
  C:\Windows\System\jRzqWPe.exe
  2⤵
  PID:4740
- C:\Windows\System\FGmsrYx.exe
  C:\Windows\System\FGmsrYx.exe
  2⤵
  PID:4976
- C:\Windows\System\lutahrq.exe
  C:\Windows\System\lutahrq.exe
  2⤵
  PID:4972
- C:\Windows\System\ohLpOkn.exe
  C:\Windows\System\ohLpOkn.exe
  2⤵
  PID:4928
- C:\Windows\System\yUMntpA.exe
  C:\Windows\System\yUMntpA.exe
  2⤵
  PID:4992
- C:\Windows\System\LPoMgCV.exe
  C:\Windows\System\LPoMgCV.exe
  2⤵
  PID:4896
- C:\Windows\System\jiEwUZA.exe
  C:\Windows\System\jiEwUZA.exe
  2⤵
  PID:5016
- C:\Windows\System\WdmnsLa.exe
  C:\Windows\System\WdmnsLa.exe
  2⤵
  PID:5028
- C:\Windows\System\QGTHkmL.exe
  C:\Windows\System\QGTHkmL.exe
  2⤵
  PID:5052
- C:\Windows\System\tTTrnOr.exe
  C:\Windows\System\tTTrnOr.exe
  2⤵
  PID:5064
- C:\Windows\System\cEYHQkV.exe
  C:\Windows\System\cEYHQkV.exe
  2⤵
  PID:5116
- C:\Windows\System\vFzddzS.exe
  C:\Windows\System\vFzddzS.exe
  2⤵
  PID:4104
- C:\Windows\System\uoEysUu.exe
  C:\Windows\System\uoEysUu.exe
  2⤵
  PID:4144
- C:\Windows\System\xJicvwF.exe
  C:\Windows\System\xJicvwF.exe
  2⤵
  PID:4236
- C:\Windows\System\PUBZVIZ.exe
  C:\Windows\System\PUBZVIZ.exe
  2⤵
  PID:4284
- C:\Windows\System\mOQgbbo.exe
  C:\Windows\System\mOQgbbo.exe
  2⤵
  PID:4324
- C:\Windows\System\HJWhpHO.exe
  C:\Windows\System\HJWhpHO.exe
  2⤵
  PID:4460
- C:\Windows\System\jZksFct.exe
  C:\Windows\System\jZksFct.exe
  2⤵
  PID:4520
- C:\Windows\System\OuQSBSi.exe
  C:\Windows\System\OuQSBSi.exe
  2⤵
  PID:5004
- C:\Windows\System\OCKYMJU.exe
  C:\Windows\System\OCKYMJU.exe
  2⤵
  PID:4304
- C:\Windows\System\msWhvNL.exe
  C:\Windows\System\msWhvNL.exe
  2⤵
  PID:4776
- C:\Windows\System\PYZjuDi.exe
  C:\Windows\System\PYZjuDi.exe
  2⤵
  PID:4376
- C:\Windows\System\UtBLbIs.exe
  C:\Windows\System\UtBLbIs.exe
  2⤵
  PID:4572
- C:\Windows\System\HVFaedS.exe
  C:\Windows\System\HVFaedS.exe
  2⤵
  PID:4880
- C:\Windows\System\kwaQDgQ.exe
  C:\Windows\System\kwaQDgQ.exe
  2⤵
  PID:5080
- C:\Windows\System\LCTpjip.exe
  C:\Windows\System\LCTpjip.exe
  2⤵
  PID:4796
- C:\Windows\System\cMeikGP.exe
  C:\Windows\System\cMeikGP.exe
  2⤵
  PID:4940
- C:\Windows\System\eIhMjkb.exe
  C:\Windows\System\eIhMjkb.exe
  2⤵
  PID:5084
- C:\Windows\System\jaTUubp.exe
  C:\Windows\System\jaTUubp.exe
  2⤵
  PID:4396
- C:\Windows\System\VtAHyfw.exe
  C:\Windows\System\VtAHyfw.exe
  2⤵
  PID:4124
- C:\Windows\System\pWyjGpm.exe
  C:\Windows\System\pWyjGpm.exe
  2⤵
  PID:4628
- C:\Windows\System\hRkjQFQ.exe
  C:\Windows\System\hRkjQFQ.exe
  2⤵
  PID:4632
- C:\Windows\System\GueDSiL.exe
  C:\Windows\System\GueDSiL.exe
  2⤵
  PID:4728
- C:\Windows\System\VpXjNxs.exe
  C:\Windows\System\VpXjNxs.exe
  2⤵
  PID:4164
- C:\Windows\System\FWLDnJQ.exe
  C:\Windows\System\FWLDnJQ.exe
  2⤵
  PID:4772
- C:\Windows\System\dUfEmsF.exe
  C:\Windows\System\dUfEmsF.exe
  2⤵
  PID:4872
- C:\Windows\System\RilEdDs.exe
  C:\Windows\System\RilEdDs.exe
  2⤵
  PID:4232
- C:\Windows\System\bdVShMp.exe
  C:\Windows\System\bdVShMp.exe
  2⤵
  PID:5032
- C:\Windows\System\nTYUiza.exe
  C:\Windows\System\nTYUiza.exe
  2⤵
  PID:4340
- C:\Windows\System\TKmFgXX.exe
  C:\Windows\System\TKmFgXX.exe
  2⤵
  PID:4692
- C:\Windows\System\rcSiXhy.exe
  C:\Windows\System\rcSiXhy.exe
  2⤵
  PID:4616
- C:\Windows\System\yYuKxek.exe
  C:\Windows\System\yYuKxek.exe
  2⤵
  PID:4584
- C:\Windows\System\tcpsDlk.exe
  C:\Windows\System\tcpsDlk.exe
  2⤵
  PID:5044
- C:\Windows\System\KPdAfVF.exe
  C:\Windows\System\KPdAfVF.exe
  2⤵
  PID:5132
- C:\Windows\System\TAOOpZE.exe
  C:\Windows\System\TAOOpZE.exe
  2⤵
  PID:5152
- C:\Windows\System\MnOdJqH.exe
  C:\Windows\System\MnOdJqH.exe
  2⤵
  PID:5168
- C:\Windows\System\uEaPZRs.exe
  C:\Windows\System\uEaPZRs.exe
  2⤵
  PID:5184
- C:\Windows\System\VNEzfNo.exe
  C:\Windows\System\VNEzfNo.exe
  2⤵
  PID:5200
- C:\Windows\System\cLbartW.exe
  C:\Windows\System\cLbartW.exe
  2⤵
  PID:5216
- C:\Windows\System\qNiPyVS.exe
  C:\Windows\System\qNiPyVS.exe
  2⤵
  PID:5232
- C:\Windows\System\SBZehJi.exe
  C:\Windows\System\SBZehJi.exe
  2⤵
  PID:5368
- C:\Windows\System\EyGOPLo.exe
  C:\Windows\System\EyGOPLo.exe
  2⤵
  PID:5384
- C:\Windows\System\CZiqLMv.exe
  C:\Windows\System\CZiqLMv.exe
  2⤵
  PID:5400
- C:\Windows\System\AYtPknL.exe
  C:\Windows\System\AYtPknL.exe
  2⤵
  PID:5416
- C:\Windows\System\OFknGcy.exe
  C:\Windows\System\OFknGcy.exe
  2⤵
  PID:5432
- C:\Windows\System\gBmQnWE.exe
  C:\Windows\System\gBmQnWE.exe
  2⤵
  PID:5448
- C:\Windows\System\yRusLEu.exe
  C:\Windows\System\yRusLEu.exe
  2⤵
  PID:5464
- C:\Windows\System\CtdLeeL.exe
  C:\Windows\System\CtdLeeL.exe
  2⤵
  PID:5480
- C:\Windows\System\ePrlQcI.exe
  C:\Windows\System\ePrlQcI.exe
  2⤵
  PID:5496
- C:\Windows\System\TLBvPZV.exe
  C:\Windows\System\TLBvPZV.exe
  2⤵
  PID:5516
- C:\Windows\System\GVWYqlt.exe
  C:\Windows\System\GVWYqlt.exe
  2⤵
  PID:5568
- C:\Windows\System\VMoAAgH.exe
  C:\Windows\System\VMoAAgH.exe
  2⤵
  PID:5584
- C:\Windows\System\TvOLwOi.exe
  C:\Windows\System\TvOLwOi.exe
  2⤵
  PID:5600
- C:\Windows\System\fLQTPGS.exe
  C:\Windows\System\fLQTPGS.exe
  2⤵
  PID:5616
- C:\Windows\System\kPMdded.exe
  C:\Windows\System\kPMdded.exe
  2⤵
  PID:5632
- C:\Windows\System\xHXpZyc.exe
  C:\Windows\System\xHXpZyc.exe
  2⤵
  PID:5648
- C:\Windows\System\ZmydRMF.exe
  C:\Windows\System\ZmydRMF.exe
  2⤵
  PID:5664
- C:\Windows\System\jMeNglZ.exe
  C:\Windows\System\jMeNglZ.exe
  2⤵
  PID:5680
- C:\Windows\System\RxxQZLU.exe
  C:\Windows\System\RxxQZLU.exe
  2⤵
  PID:5696
- C:\Windows\System\KxaEXJg.exe
  C:\Windows\System\KxaEXJg.exe
  2⤵
  PID:5716
- C:\Windows\System\AcrIaUt.exe
  C:\Windows\System\AcrIaUt.exe
  2⤵
  PID:5736
- C:\Windows\System\uPqFefl.exe
  C:\Windows\System\uPqFefl.exe
  2⤵
  PID:5788
- C:\Windows\System\CGVJMdl.exe
  C:\Windows\System\CGVJMdl.exe
  2⤵
  PID:5804
- C:\Windows\System\ENpDbDc.exe
  C:\Windows\System\ENpDbDc.exe
  2⤵
  PID:5820
- C:\Windows\System\CINiVug.exe
  C:\Windows\System\CINiVug.exe
  2⤵
  PID:5836
- C:\Windows\System\YOaGwMh.exe
  C:\Windows\System\YOaGwMh.exe
  2⤵
  PID:5852
- C:\Windows\System\gcndSPN.exe
  C:\Windows\System\gcndSPN.exe
  2⤵
  PID:5868
- C:\Windows\System\qRfWYvB.exe
  C:\Windows\System\qRfWYvB.exe
  2⤵
  PID:5884
- C:\Windows\System\vMKalgy.exe
  C:\Windows\System\vMKalgy.exe
  2⤵
  PID:5900
- C:\Windows\System\RfDOvjy.exe
  C:\Windows\System\RfDOvjy.exe
  2⤵
  PID:5916
- C:\Windows\System\LbDuqKw.exe
  C:\Windows\System\LbDuqKw.exe
  2⤵
  PID:5932
- C:\Windows\System\MqpyUfa.exe
  C:\Windows\System\MqpyUfa.exe
  2⤵
  PID:5948
- C:\Windows\System\WPoQEPg.exe
  C:\Windows\System\WPoQEPg.exe
  2⤵
  PID:5964
- C:\Windows\System\xhXZYWU.exe
  C:\Windows\System\xhXZYWU.exe
  2⤵
  PID:5980
- C:\Windows\System\iZPUzfB.exe
  C:\Windows\System\iZPUzfB.exe
  2⤵
  PID:5996
- C:\Windows\System\MlYkbLV.exe
  C:\Windows\System\MlYkbLV.exe
  2⤵
  PID:6012
- C:\Windows\System\bbHZZFQ.exe
  C:\Windows\System\bbHZZFQ.exe
  2⤵
  PID:6028
- C:\Windows\System\njQdPuG.exe
  C:\Windows\System\njQdPuG.exe
  2⤵
  PID:6044
- C:\Windows\System\kzZSnPl.exe
  C:\Windows\System\kzZSnPl.exe
  2⤵
  PID:6060
- C:\Windows\System\QiJQUQJ.exe
  C:\Windows\System\QiJQUQJ.exe
  2⤵
  PID:6076
- C:\Windows\System\SxNtttP.exe
  C:\Windows\System\SxNtttP.exe
  2⤵
  PID:6096
- C:\Windows\System\pxFnEYF.exe
  C:\Windows\System\pxFnEYF.exe
  2⤵
  PID:6112
- C:\Windows\System\tBZbXVh.exe
  C:\Windows\System\tBZbXVh.exe
  2⤵
  PID:6128
- C:\Windows\System\tVvYmzc.exe
  C:\Windows\System\tVvYmzc.exe
  2⤵
  PID:4696
- C:\Windows\System\gWATYCi.exe
  C:\Windows\System\gWATYCi.exe
  2⤵
  PID:4276
- C:\Windows\System\ovwBWZb.exe
  C:\Windows\System\ovwBWZb.exe
  2⤵
  PID:5056
- C:\Windows\System\OhTCffz.exe
  C:\Windows\System\OhTCffz.exe
  2⤵
  PID:4496
- C:\Windows\System\qJZcBuM.exe
  C:\Windows\System\qJZcBuM.exe
  2⤵
  PID:5160
- C:\Windows\System\PyXMyWZ.exe
  C:\Windows\System\PyXMyWZ.exe
  2⤵
  PID:5228
- C:\Windows\System\tGNJedn.exe
  C:\Windows\System\tGNJedn.exe
  2⤵
  PID:4756
- C:\Windows\System\sJXKTAa.exe
  C:\Windows\System\sJXKTAa.exe
  2⤵
  PID:5012
- C:\Windows\System\qZTimhx.exe
  C:\Windows\System\qZTimhx.exe
  2⤵
  PID:5176
- C:\Windows\System\lfgxRRN.exe
  C:\Windows\System\lfgxRRN.exe
  2⤵
  PID:5240
- C:\Windows\System\CdlmVpZ.exe
  C:\Windows\System\CdlmVpZ.exe
  2⤵
  PID:5256
- C:\Windows\System\jQKyhtv.exe
  C:\Windows\System\jQKyhtv.exe
  2⤵
  PID:5272
- C:\Windows\System\naPhZpt.exe
  C:\Windows\System\naPhZpt.exe
  2⤵
  PID:5292
- C:\Windows\System\jlWPNxw.exe
  C:\Windows\System\jlWPNxw.exe
  2⤵
  PID:5332
- C:\Windows\System\GJIiPwp.exe
  C:\Windows\System\GJIiPwp.exe
  2⤵
  PID:5316
- C:\Windows\System\DxwwLJX.exe
  C:\Windows\System\DxwwLJX.exe
  2⤵
  PID:5308
- C:\Windows\System\SyWdAxG.exe
  C:\Windows\System\SyWdAxG.exe
  2⤵
  PID:5364
- C:\Windows\System\CwuiNiB.exe
  C:\Windows\System\CwuiNiB.exe
  2⤵
  PID:5396
- C:\Windows\System\lMAKmNd.exe
  C:\Windows\System\lMAKmNd.exe
  2⤵
  PID:5440
- C:\Windows\System\UOoSZXB.exe
  C:\Windows\System\UOoSZXB.exe
  2⤵
  PID:5504
- C:\Windows\System\llgCqXA.exe
  C:\Windows\System\llgCqXA.exe
  2⤵
  PID:5428
- C:\Windows\System\YeHRqLA.exe
  C:\Windows\System\YeHRqLA.exe
  2⤵
  PID:5492
- C:\Windows\System\MtuNmpr.exe
  C:\Windows\System\MtuNmpr.exe
  2⤵
  PID:5532
- C:\Windows\System\Hggylaj.exe
  C:\Windows\System\Hggylaj.exe
  2⤵
  PID:5548
- C:\Windows\System\hLEwJsn.exe
  C:\Windows\System\hLEwJsn.exe
  2⤵
  PID:5580
- C:\Windows\System\FtDupPU.exe
  C:\Windows\System\FtDupPU.exe
  2⤵
  PID:5644
- C:\Windows\System\acEBUgQ.exe
  C:\Windows\System\acEBUgQ.exe
  2⤵
  PID:5624
- C:\Windows\System\zrKwRfB.exe
  C:\Windows\System\zrKwRfB.exe
  2⤵
  PID:5596
- C:\Windows\System\tVLAjSH.exe
  C:\Windows\System\tVLAjSH.exe
  2⤵
  PID:5692
- C:\Windows\System\gNPIqGt.exe
  C:\Windows\System\gNPIqGt.exe
  2⤵
  PID:5972
- C:\Windows\System\GRBulbt.exe
  C:\Windows\System\GRBulbt.exe
  2⤵
  PID:6008
- C:\Windows\System\jkTCGpl.exe
  C:\Windows\System\jkTCGpl.exe
  2⤵
  PID:5828
- C:\Windows\System\PMZGmVi.exe
  C:\Windows\System\PMZGmVi.exe
  2⤵
  PID:5892
- C:\Windows\System\EwXddhS.exe
  C:\Windows\System\EwXddhS.exe
  2⤵
  PID:5988
- C:\Windows\System\ntZOjln.exe
  C:\Windows\System\ntZOjln.exe
  2⤵
  PID:6092
- C:\Windows\System\YgMBiZy.exe
  C:\Windows\System\YgMBiZy.exe
  2⤵
  PID:6072
- C:\Windows\System\qVdnPPK.exe
  C:\Windows\System\qVdnPPK.exe
  2⤵
  PID:6140
- C:\Windows\System\EFdlPtN.exe
  C:\Windows\System\EFdlPtN.exe
  2⤵
  PID:4588
- C:\Windows\System\laSMvyy.exe
  C:\Windows\System\laSMvyy.exe
  2⤵
  PID:5196
- C:\Windows\System\haRvYfz.exe
  C:\Windows\System\haRvYfz.exe
  2⤵
  PID:5224
- C:\Windows\System\AqxsYAR.exe
  C:\Windows\System\AqxsYAR.exe
  2⤵
  PID:5280
- C:\Windows\System\iOIzHOy.exe
  C:\Windows\System\iOIzHOy.exe
  2⤵
  PID:4892
- C:\Windows\System\jPQpUXo.exe
  C:\Windows\System\jPQpUXo.exe
  2⤵
  PID:5144
- C:\Windows\System\ONkMARl.exe
  C:\Windows\System\ONkMARl.exe
  2⤵
  PID:5288
- C:\Windows\System\QMdUzLp.exe
  C:\Windows\System\QMdUzLp.exe
  2⤵
  PID:5356
- C:\Windows\System\zeZdvAA.exe
  C:\Windows\System\zeZdvAA.exe
  2⤵
  PID:5424
- C:\Windows\System\IdFEAVa.exe
  C:\Windows\System\IdFEAVa.exe
  2⤵
  PID:5552
- C:\Windows\System\rZlhspg.exe
  C:\Windows\System\rZlhspg.exe
  2⤵
  PID:5660
- C:\Windows\System\CLZgWbD.exe
  C:\Windows\System\CLZgWbD.exe
  2⤵
  PID:5264
- C:\Windows\System\dYewdmz.exe
  C:\Windows\System\dYewdmz.exe
  2⤵
  PID:5472
- C:\Windows\System\GcUbzHF.exe
  C:\Windows\System\GcUbzHF.exe
  2⤵
  PID:5300
- C:\Windows\System\uvhGEKt.exe
  C:\Windows\System\uvhGEKt.exe
  2⤵
  PID:5460
- C:\Windows\System\zAXlJgS.exe
  C:\Windows\System\zAXlJgS.exe
  2⤵
  PID:5608
- C:\Windows\System\iLsRkVO.exe
  C:\Windows\System\iLsRkVO.exe
  2⤵
  PID:5756
- C:\Windows\System\uENyyFF.exe
  C:\Windows\System\uENyyFF.exe
  2⤵
  PID:5748
- C:\Windows\System\PWDEaoa.exe
  C:\Windows\System\PWDEaoa.exe
  2⤵
  PID:5780
- C:\Windows\System\lKHRqLu.exe
  C:\Windows\System\lKHRqLu.exe
  2⤵
  PID:5816
- C:\Windows\System\ChEdSrP.exe
  C:\Windows\System\ChEdSrP.exe
  2⤵
  PID:5880
- C:\Windows\System\RKpZCVO.exe
  C:\Windows\System\RKpZCVO.exe
  2⤵
  PID:5860
- C:\Windows\System\LpjhrZr.exe
  C:\Windows\System\LpjhrZr.exe
  2⤵
  PID:6136
- C:\Windows\System\qmSIQWl.exe
  C:\Windows\System\qmSIQWl.exe
  2⤵
  PID:5040
- C:\Windows\System\MtpGnuG.exe
  C:\Windows\System\MtpGnuG.exe
  2⤵
  PID:5352
- C:\Windows\System\QXJZKqK.exe
  C:\Windows\System\QXJZKqK.exe
  2⤵
  PID:5212
- C:\Windows\System\oVOIrbh.exe
  C:\Windows\System\oVOIrbh.exe
  2⤵
  PID:5488
- C:\Windows\System\xUbISAu.exe
  C:\Windows\System\xUbISAu.exe
  2⤵
  PID:5380
- C:\Windows\System\gDUgsyy.exe
  C:\Windows\System\gDUgsyy.exe
  2⤵
  PID:5728
- C:\Windows\System\UrWxAzp.exe
  C:\Windows\System\UrWxAzp.exe
  2⤵
  PID:5960
- C:\Windows\System\mosuchK.exe
  C:\Windows\System\mosuchK.exe
  2⤵
  PID:5060
- C:\Windows\System\UVdDQLY.exe
  C:\Windows\System\UVdDQLY.exe
  2⤵
  PID:5284
- C:\Windows\System\cUjWWjh.exe
  C:\Windows\System\cUjWWjh.exe
  2⤵
  PID:6056
- C:\Windows\System\JDfuIWP.exe
  C:\Windows\System\JDfuIWP.exe
  2⤵
  PID:5512
- C:\Windows\System\RZsyTvI.exe
  C:\Windows\System\RZsyTvI.exe
  2⤵
  PID:5208
- C:\Windows\System\TTWpHfz.exe
  C:\Windows\System\TTWpHfz.exe
  2⤵
  PID:5784
- C:\Windows\System\kHmckfk.exe
  C:\Windows\System\kHmckfk.exe
  2⤵
  PID:5796
- C:\Windows\System\NNTFihU.exe
  C:\Windows\System\NNTFihU.exe
  2⤵
  PID:6004
- C:\Windows\System\JmGCcJe.exe
  C:\Windows\System\JmGCcJe.exe
  2⤵
  PID:5708
- C:\Windows\System\KlvlAyy.exe
  C:\Windows\System\KlvlAyy.exe
  2⤵
  PID:5924
- C:\Windows\System\UoLGwZp.exe
  C:\Windows\System\UoLGwZp.exe
  2⤵
  PID:6156
- C:\Windows\System\FBTrcDU.exe
  C:\Windows\System\FBTrcDU.exe
  2⤵
  PID:6184
- C:\Windows\System\ZipoIEC.exe
  C:\Windows\System\ZipoIEC.exe
  2⤵
  PID:6204
- C:\Windows\System\AkxNRtz.exe
  C:\Windows\System\AkxNRtz.exe
  2⤵
  PID:6220
- C:\Windows\System\ikxMFCi.exe
  C:\Windows\System\ikxMFCi.exe
  2⤵
  PID:6236
- C:\Windows\System\CcuvzYO.exe
  C:\Windows\System\CcuvzYO.exe
  2⤵
  PID:6252
- C:\Windows\System\CcavnUX.exe
  C:\Windows\System\CcavnUX.exe
  2⤵
  PID:6268
- C:\Windows\System\YJPDlMq.exe
  C:\Windows\System\YJPDlMq.exe
  2⤵
  PID:6284
- C:\Windows\System\opFIBtM.exe
  C:\Windows\System\opFIBtM.exe
  2⤵
  PID:6304
- C:\Windows\System\LmWgeoj.exe
  C:\Windows\System\LmWgeoj.exe
  2⤵
  PID:6328
- C:\Windows\System\NgwGduH.exe
  C:\Windows\System\NgwGduH.exe
  2⤵
  PID:6344
- C:\Windows\System\hBMlQmt.exe
  C:\Windows\System\hBMlQmt.exe
  2⤵
  PID:6364
- C:\Windows\System\SCtirld.exe
  C:\Windows\System\SCtirld.exe
  2⤵
  PID:6380
- C:\Windows\System\umTkHwM.exe
  C:\Windows\System\umTkHwM.exe
  2⤵
  PID:6396
- C:\Windows\System\fUDIByL.exe
  C:\Windows\System\fUDIByL.exe
  2⤵
  PID:6412
- C:\Windows\System\mdLbvFL.exe
  C:\Windows\System\mdLbvFL.exe
  2⤵
  PID:6428
- C:\Windows\System\KjrtMZw.exe
  C:\Windows\System\KjrtMZw.exe
  2⤵
  PID:6444
- C:\Windows\System\AtRcPXq.exe
  C:\Windows\System\AtRcPXq.exe
  2⤵
  PID:6460
- C:\Windows\System\IUeCWHd.exe
  C:\Windows\System\IUeCWHd.exe
  2⤵
  PID:6476
- C:\Windows\System\giHgeeg.exe
  C:\Windows\System\giHgeeg.exe
  2⤵
  PID:6492
- C:\Windows\System\HlHRxWK.exe
  C:\Windows\System\HlHRxWK.exe
  2⤵
  PID:6508
- C:\Windows\System\HecKuCn.exe
  C:\Windows\System\HecKuCn.exe
  2⤵
  PID:6524
- C:\Windows\System\cstgElJ.exe
  C:\Windows\System\cstgElJ.exe
  2⤵
  PID:6540
- C:\Windows\System\JoyLsiY.exe
  C:\Windows\System\JoyLsiY.exe
  2⤵
  PID:6556
- C:\Windows\System\HbfkaeE.exe
  C:\Windows\System\HbfkaeE.exe
  2⤵
  PID:6576
- C:\Windows\System\xqGXYkB.exe
  C:\Windows\System\xqGXYkB.exe
  2⤵
  PID:6592
- C:\Windows\System\GgnDPBH.exe
  C:\Windows\System\GgnDPBH.exe
  2⤵
  PID:6608
- C:\Windows\System\FOvXuNw.exe
  C:\Windows\System\FOvXuNw.exe
  2⤵
  PID:6628
- C:\Windows\System\WsXujfD.exe
  C:\Windows\System\WsXujfD.exe
  2⤵
  PID:6644
- C:\Windows\System\NTpicoz.exe
  C:\Windows\System\NTpicoz.exe
  2⤵
  PID:6660
- C:\Windows\System\SfaWqNz.exe
  C:\Windows\System\SfaWqNz.exe
  2⤵
  PID:6676
- C:\Windows\System\ZfwAxpW.exe
  C:\Windows\System\ZfwAxpW.exe
  2⤵
  PID:6692
- C:\Windows\System\EHGEHnP.exe
  C:\Windows\System\EHGEHnP.exe
  2⤵
  PID:6708
- C:\Windows\System\vTkFqji.exe
  C:\Windows\System\vTkFqji.exe
  2⤵
  PID:6724
- C:\Windows\System\rGgcgxj.exe
  C:\Windows\System\rGgcgxj.exe
  2⤵
  PID:6740
- C:\Windows\System\VUiiqXD.exe
  C:\Windows\System\VUiiqXD.exe
  2⤵
  PID:6756
- C:\Windows\System\QIsUsjs.exe
  C:\Windows\System\QIsUsjs.exe
  2⤵
  PID:6772
- C:\Windows\System\HmTwuRA.exe
  C:\Windows\System\HmTwuRA.exe
  2⤵
  PID:6788
- C:\Windows\System\AXXHzCP.exe
  C:\Windows\System\AXXHzCP.exe
  2⤵
  PID:6808
- C:\Windows\System\rnTrSwu.exe
  C:\Windows\System\rnTrSwu.exe
  2⤵
  PID:6824
- C:\Windows\System\gVhGBQV.exe
  C:\Windows\System\gVhGBQV.exe
  2⤵
  PID:6840
- C:\Windows\System\zFXbIQY.exe
  C:\Windows\System\zFXbIQY.exe
  2⤵
  PID:6856
- C:\Windows\System\uUoWAbU.exe
  C:\Windows\System\uUoWAbU.exe
  2⤵
  PID:6872
- C:\Windows\System\VxqGNzZ.exe
  C:\Windows\System\VxqGNzZ.exe
  2⤵
  PID:6888
- C:\Windows\System\fEHqmxK.exe
  C:\Windows\System\fEHqmxK.exe
  2⤵
  PID:6908
- C:\Windows\System\zhETxWy.exe
  C:\Windows\System\zhETxWy.exe
  2⤵
  PID:6924
- C:\Windows\System\glyitBw.exe
  C:\Windows\System\glyitBw.exe
  2⤵
  PID:6940
- C:\Windows\System\JiRGMyl.exe
  C:\Windows\System\JiRGMyl.exe
  2⤵
  PID:6956
- C:\Windows\System\FDFUtTG.exe
  C:\Windows\System\FDFUtTG.exe
  2⤵
  PID:6972
- C:\Windows\System\RdebBIF.exe
  C:\Windows\System\RdebBIF.exe
  2⤵
  PID:6988
- C:\Windows\System\whcPaCZ.exe
  C:\Windows\System\whcPaCZ.exe
  2⤵
  PID:7004
- C:\Windows\System\keSnsxn.exe
  C:\Windows\System\keSnsxn.exe
  2⤵
  PID:7020
- C:\Windows\System\ZVmWsMu.exe
  C:\Windows\System\ZVmWsMu.exe
  2⤵
  PID:7036
- C:\Windows\System\YXrKwbk.exe
  C:\Windows\System\YXrKwbk.exe
  2⤵
  PID:7052
- C:\Windows\System\hUkJOzi.exe
  C:\Windows\System\hUkJOzi.exe
  2⤵
  PID:7068
- C:\Windows\System\bmHQPFR.exe
  C:\Windows\System\bmHQPFR.exe
  2⤵
  PID:7084
- C:\Windows\System\UpvurVn.exe
  C:\Windows\System\UpvurVn.exe
  2⤵
  PID:7100
- C:\Windows\System\znNjPgh.exe
  C:\Windows\System\znNjPgh.exe
  2⤵
  PID:7116
- C:\Windows\System\KRCLnBx.exe
  C:\Windows\System\KRCLnBx.exe
  2⤵
  PID:7132
- C:\Windows\System\oDUByiw.exe
  C:\Windows\System\oDUByiw.exe
  2⤵
  PID:7148
- C:\Windows\System\MYOdyfQ.exe
  C:\Windows\System\MYOdyfQ.exe
  2⤵
  PID:7164
- C:\Windows\System\qxupecD.exe
  C:\Windows\System\qxupecD.exe
  2⤵
  PID:5320
- C:\Windows\System\enjONOX.exe
  C:\Windows\System\enjONOX.exe
  2⤵
  PID:4664
- C:\Windows\System\RdQXHWs.exe
  C:\Windows\System\RdQXHWs.exe
  2⤵
  PID:6124
- C:\Windows\System\TmQAISB.exe
  C:\Windows\System\TmQAISB.exe
  2⤵
  PID:5672
- C:\Windows\System\wJKIGbs.exe
  C:\Windows\System\wJKIGbs.exe
  2⤵
  PID:5640
- C:\Windows\System\TjMFkSB.exe
  C:\Windows\System\TjMFkSB.exe
  2⤵
  PID:5752
- C:\Windows\System\RQZMXlm.exe
  C:\Windows\System\RQZMXlm.exe
  2⤵
  PID:5392
- C:\Windows\System\Itmnfwz.exe
  C:\Windows\System\Itmnfwz.exe
  2⤵
  PID:4860
- C:\Windows\System\UUWOHtP.exe
  C:\Windows\System\UUWOHtP.exe
  2⤵
  PID:6180
- C:\Windows\System\YIATnbS.exe
  C:\Windows\System\YIATnbS.exe
  2⤵
  PID:6196
- C:\Windows\System\hmkZUDp.exe
  C:\Windows\System\hmkZUDp.exe
  2⤵
  PID:6264
- C:\Windows\System\onfPkBP.exe
  C:\Windows\System\onfPkBP.exe
  2⤵
  PID:6216
- C:\Windows\System\pCCTPLZ.exe
  C:\Windows\System\pCCTPLZ.exe
  2⤵
  PID:6276
- C:\Windows\System\sMeNZYS.exe
  C:\Windows\System\sMeNZYS.exe
  2⤵
  PID:6340
- C:\Windows\System\klHZARl.exe
  C:\Windows\System\klHZARl.exe
  2⤵
  PID:6408
- C:\Windows\System\jvBAtmW.exe
  C:\Windows\System\jvBAtmW.exe
  2⤵
  PID:6356
- C:\Windows\System\LeJZyzo.exe
  C:\Windows\System\LeJZyzo.exe
  2⤵
  PID:6424
- C:\Windows\System\WUoINmD.exe
  C:\Windows\System\WUoINmD.exe
  2⤵
  PID:6516
- C:\Windows\System\cSVwOCL.exe
  C:\Windows\System\cSVwOCL.exe
  2⤵
  PID:6584
- C:\Windows\System\CafPXIC.exe
  C:\Windows\System\CafPXIC.exe
  2⤵
  PID:6656
- C:\Windows\System\ZvuyajK.exe
  C:\Windows\System\ZvuyajK.exe
  2⤵
  PID:6736
- C:\Windows\System\zZfQpMF.exe
  C:\Windows\System\zZfQpMF.exe
  2⤵
  PID:6720
- C:\Windows\System\lrtxGLT.exe
  C:\Windows\System\lrtxGLT.exe
  2⤵
  PID:6436
- C:\Windows\System\bnofUaa.exe
  C:\Windows\System\bnofUaa.exe
  2⤵
  PID:6852
- C:\Windows\System\AFKwQes.exe
  C:\Windows\System\AFKwQes.exe
  2⤵
  PID:6536
- C:\Windows\System\KeyrPKr.exe
  C:\Windows\System\KeyrPKr.exe
  2⤵
  PID:6672
- C:\Windows\System\hrNQIQL.exe
  C:\Windows\System\hrNQIQL.exe
  2⤵
  PID:6468
- C:\Windows\System\NDNCRop.exe
  C:\Windows\System\NDNCRop.exe
  2⤵
  PID:6564
- C:\Windows\System\dNSdxPq.exe
  C:\Windows\System\dNSdxPq.exe
  2⤵
  PID:6640
- C:\Windows\System\ZrjxwCT.exe
  C:\Windows\System\ZrjxwCT.exe
  2⤵
  PID:6832
- C:\Windows\System\hUpGSyC.exe
  C:\Windows\System\hUpGSyC.exe
  2⤵
  PID:6904
- C:\Windows\System\LcggjeZ.exe
  C:\Windows\System\LcggjeZ.exe
  2⤵
  PID:6948
- C:\Windows\System\kvrdbFu.exe
  C:\Windows\System\kvrdbFu.exe
  2⤵
  PID:6984
- C:\Windows\System\hfRTpyb.exe
  C:\Windows\System\hfRTpyb.exe
  2⤵
  PID:6968
- C:\Windows\System\zrsNzmf.exe
  C:\Windows\System\zrsNzmf.exe
  2⤵
  PID:7060
- C:\Windows\System\LubCTXg.exe
  C:\Windows\System\LubCTXg.exe
  2⤵
  PID:7144
- C:\Windows\System\BfDNBlT.exe
  C:\Windows\System\BfDNBlT.exe
  2⤵
  PID:7028
- C:\Windows\System\sAGUIbu.exe
  C:\Windows\System\sAGUIbu.exe
  2⤵
  PID:5128
- C:\Windows\System\ngkDqYd.exe
  C:\Windows\System\ngkDqYd.exe
  2⤵
  PID:5712
- C:\Windows\System\ktXeeKV.exe
  C:\Windows\System\ktXeeKV.exe
  2⤵
  PID:7156
- C:\Windows\System\qRoskxm.exe
  C:\Windows\System\qRoskxm.exe
  2⤵
  PID:5940
- C:\Windows\System\FlhyHDA.exe
  C:\Windows\System\FlhyHDA.exe
  2⤵
  PID:4240
- C:\Windows\System\wquleXj.exe
  C:\Windows\System\wquleXj.exe
  2⤵
  PID:6232
- C:\Windows\System\OaNPDna.exe
  C:\Windows\System\OaNPDna.exe
  2⤵
  PID:6248
- C:\Windows\System\OYJTEbm.exe
  C:\Windows\System\OYJTEbm.exe
  2⤵
  PID:6392
- C:\Windows\System\qDvxJFW.exe
  C:\Windows\System\qDvxJFW.exe
  2⤵
  PID:6336
- C:\Windows\System\YnaeZAi.exe
  C:\Windows\System\YnaeZAi.exe
  2⤵
  PID:6324
- C:\Windows\System\NvPIJtK.exe
  C:\Windows\System\NvPIJtK.exe
  2⤵
  PID:6704
- C:\Windows\System\TBViAee.exe
  C:\Windows\System\TBViAee.exe
  2⤵
  PID:6484
- C:\Windows\System\dAUQRZX.exe
  C:\Windows\System\dAUQRZX.exe
  2⤵
  PID:6620
- C:\Windows\System\SDideFV.exe
  C:\Windows\System\SDideFV.exe
  2⤵
  PID:6848
- C:\Windows\System\NQdRtts.exe
  C:\Windows\System\NQdRtts.exe
  2⤵
  PID:6668
- C:\Windows\System\aVeEpyu.exe
  C:\Windows\System\aVeEpyu.exe
  2⤵
  PID:6800
- C:\Windows\System\WCczpFJ.exe
  C:\Windows\System\WCczpFJ.exe
  2⤵
  PID:6936
- C:\Windows\System\OGyqzLR.exe
  C:\Windows\System\OGyqzLR.exe
  2⤵
  PID:6900
- C:\Windows\System\LXDGPRu.exe
  C:\Windows\System\LXDGPRu.exe
  2⤵
  PID:7076
- C:\Windows\System\qUttoGb.exe
  C:\Windows\System\qUttoGb.exe
  2⤵
  PID:5592
- C:\Windows\System\nExLaWc.exe
  C:\Windows\System\nExLaWc.exe
  2⤵
  PID:7016
- C:\Windows\System\nzPKVHh.exe
  C:\Windows\System\nzPKVHh.exe
  2⤵
  PID:7140
- C:\Windows\System\odYXdUH.exe
  C:\Windows\System\odYXdUH.exe
  2⤵
  PID:6228
- C:\Windows\System\cxjTTfJ.exe
  C:\Windows\System\cxjTTfJ.exe
  2⤵
  PID:7092
- C:\Windows\System\ZqzKiBj.exe
  C:\Windows\System\ZqzKiBj.exe
  2⤵
  PID:7124
- C:\Windows\System\IHjUuVu.exe
  C:\Windows\System\IHjUuVu.exe
  2⤵
  PID:6372
- C:\Windows\System\pOZTPxv.exe
  C:\Windows\System\pOZTPxv.exe
  2⤵
  PID:6548
- C:\Windows\System\gyonQGj.exe
  C:\Windows\System\gyonQGj.exe
  2⤵
  PID:6532
- C:\Windows\System\jjEhSTz.exe
  C:\Windows\System\jjEhSTz.exe
  2⤵
  PID:6472
- C:\Windows\System\GxEnIIV.exe
  C:\Windows\System\GxEnIIV.exe
  2⤵
  PID:6884
- C:\Windows\System\OfRGtcn.exe
  C:\Windows\System\OfRGtcn.exe
  2⤵
  PID:6636
- C:\Windows\System\lWqsJYr.exe
  C:\Windows\System\lWqsJYr.exe
  2⤵
  PID:6388
- C:\Windows\System\TJNQTGB.exe
  C:\Windows\System\TJNQTGB.exe
  2⤵
  PID:7160
- C:\Windows\System\cHRXCKX.exe
  C:\Windows\System\cHRXCKX.exe
  2⤵
  PID:6920
- C:\Windows\System\KaVXtdJ.exe
  C:\Windows\System\KaVXtdJ.exe
  2⤵
  PID:6420
- C:\Windows\System\TVAuHlj.exe
  C:\Windows\System\TVAuHlj.exe
  2⤵
  PID:7000
- C:\Windows\System\BLeqQiw.exe
  C:\Windows\System\BLeqQiw.exe
  2⤵
  PID:6700
- C:\Windows\System\eMokRRj.exe
  C:\Windows\System\eMokRRj.exe
  2⤵
  PID:7108
- C:\Windows\System\zDytFIj.exe
  C:\Windows\System\zDytFIj.exe
  2⤵
  PID:6616
- C:\Windows\System\iNuNVTm.exe
  C:\Windows\System\iNuNVTm.exe
  2⤵
  PID:6752
- C:\Windows\System\MdnJkZq.exe
  C:\Windows\System\MdnJkZq.exe
  2⤵
  PID:5928
- C:\Windows\System\vsPNNZz.exe
  C:\Windows\System\vsPNNZz.exe
  2⤵
  PID:7184
- C:\Windows\System\mlzjehA.exe
  C:\Windows\System\mlzjehA.exe
  2⤵
  PID:7200
- C:\Windows\System\NeOnPAw.exe
  C:\Windows\System\NeOnPAw.exe
  2⤵
  PID:7216
- C:\Windows\System\ZGgPzzR.exe
  C:\Windows\System\ZGgPzzR.exe
  2⤵
  PID:7236
- C:\Windows\System\vLdeImj.exe
  C:\Windows\System\vLdeImj.exe
  2⤵
  PID:7252
- C:\Windows\System\KhDcAcl.exe
  C:\Windows\System\KhDcAcl.exe
  2⤵
  PID:7272
- C:\Windows\System\ZNmHLMx.exe
  C:\Windows\System\ZNmHLMx.exe
  2⤵
  PID:7288
- C:\Windows\System\Dmnfecx.exe
  C:\Windows\System\Dmnfecx.exe
  2⤵
  PID:7304
- C:\Windows\System\wvOCXqt.exe
  C:\Windows\System\wvOCXqt.exe
  2⤵
  PID:7320
- C:\Windows\System\UuLOHED.exe
  C:\Windows\System\UuLOHED.exe
  2⤵
  PID:7336
- C:\Windows\System\DYhUJch.exe
  C:\Windows\System\DYhUJch.exe
  2⤵
  PID:7352
- C:\Windows\System\AzDWTTq.exe
  C:\Windows\System\AzDWTTq.exe
  2⤵
  PID:7368
- C:\Windows\System\ibGIkpp.exe
  C:\Windows\System\ibGIkpp.exe
  2⤵
  PID:7384
- C:\Windows\System\pyHMmPo.exe
  C:\Windows\System\pyHMmPo.exe
  2⤵
  PID:7400
- C:\Windows\System\MmGzzqp.exe
  C:\Windows\System\MmGzzqp.exe
  2⤵
  PID:7416
- C:\Windows\System\oehBlaP.exe
  C:\Windows\System\oehBlaP.exe
  2⤵
  PID:7432
- C:\Windows\System\oAYVmXm.exe
  C:\Windows\System\oAYVmXm.exe
  2⤵
  PID:7448
- C:\Windows\System\VQALxUf.exe
  C:\Windows\System\VQALxUf.exe
  2⤵
  PID:7464
- C:\Windows\System\NhgSeId.exe
  C:\Windows\System\NhgSeId.exe
  2⤵
  PID:7600
- C:\Windows\System\sWgYVYi.exe
  C:\Windows\System\sWgYVYi.exe
  2⤵
  PID:7616
- C:\Windows\System\mInDYmd.exe
  C:\Windows\System\mInDYmd.exe
  2⤵
  PID:7632
- C:\Windows\System\JQdUtnX.exe
  C:\Windows\System\JQdUtnX.exe
  2⤵
  PID:7648
- C:\Windows\System\SuvFFcf.exe
  C:\Windows\System\SuvFFcf.exe
  2⤵
  PID:7668
- C:\Windows\System\LPCNWdZ.exe
  C:\Windows\System\LPCNWdZ.exe
  2⤵
  PID:7684
- C:\Windows\System\cSGAQtp.exe
  C:\Windows\System\cSGAQtp.exe
  2⤵
  PID:7700
- C:\Windows\System\WTVqvke.exe
  C:\Windows\System\WTVqvke.exe
  2⤵
  PID:7716
- C:\Windows\System\qgHVZgF.exe
  C:\Windows\System\qgHVZgF.exe
  2⤵
  PID:7752
- C:\Windows\System\CdTSxxv.exe
  C:\Windows\System\CdTSxxv.exe
  2⤵
  PID:7776
- C:\Windows\System\uGLmVcj.exe
  C:\Windows\System\uGLmVcj.exe
  2⤵
  PID:7792
- C:\Windows\System\KWlrmLC.exe
  C:\Windows\System\KWlrmLC.exe
  2⤵
  PID:7808
- C:\Windows\System\NaDrooO.exe
  C:\Windows\System\NaDrooO.exe
  2⤵
  PID:7824
- C:\Windows\System\WCVWdlI.exe
  C:\Windows\System\WCVWdlI.exe
  2⤵
  PID:7840
- C:\Windows\System\WnBRvyh.exe
  C:\Windows\System\WnBRvyh.exe
  2⤵
  PID:7856
- C:\Windows\System\UTLNvzd.exe
  C:\Windows\System\UTLNvzd.exe
  2⤵
  PID:7876
- C:\Windows\System\blMHBlD.exe
  C:\Windows\System\blMHBlD.exe
  2⤵
  PID:7892
- C:\Windows\System\FibtdeQ.exe
  C:\Windows\System\FibtdeQ.exe
  2⤵
  PID:7908
- C:\Windows\System\gVZCseh.exe
  C:\Windows\System\gVZCseh.exe
  2⤵
  PID:7924
- C:\Windows\System\VcBWCnZ.exe
  C:\Windows\System\VcBWCnZ.exe
  2⤵
  PID:7940
- C:\Windows\System\qkixyNh.exe
  C:\Windows\System\qkixyNh.exe
  2⤵
  PID:7956
- C:\Windows\System\QUzJiSp.exe
  C:\Windows\System\QUzJiSp.exe
  2⤵
  PID:7972
- C:\Windows\System\HdehPKW.exe
  C:\Windows\System\HdehPKW.exe
  2⤵
  PID:7988
- C:\Windows\System\HOdUZhz.exe
  C:\Windows\System\HOdUZhz.exe
  2⤵
  PID:8004
- C:\Windows\System\tBylLMO.exe
  C:\Windows\System\tBylLMO.exe
  2⤵
  PID:8020
- C:\Windows\System\wOGeyGN.exe
  C:\Windows\System\wOGeyGN.exe
  2⤵
  PID:8036
- C:\Windows\System\ZBBWSre.exe
  C:\Windows\System\ZBBWSre.exe
  2⤵
  PID:8052
- C:\Windows\System\GnwDFvV.exe
  C:\Windows\System\GnwDFvV.exe
  2⤵
  PID:8068
- C:\Windows\System\BmNHALf.exe
  C:\Windows\System\BmNHALf.exe
  2⤵
  PID:8084
- C:\Windows\System\pPKqwFR.exe
  C:\Windows\System\pPKqwFR.exe
  2⤵
  PID:8104
- C:\Windows\System\WhhuitP.exe
  C:\Windows\System\WhhuitP.exe
  2⤵
  PID:8120
- C:\Windows\System\kkVTbLD.exe
  C:\Windows\System\kkVTbLD.exe
  2⤵
  PID:8136
- C:\Windows\System\bAjWmnK.exe
  C:\Windows\System\bAjWmnK.exe
  2⤵
  PID:8156
- C:\Windows\System\HttghNI.exe
  C:\Windows\System\HttghNI.exe
  2⤵
  PID:8180
- C:\Windows\System\oqpMkNK.exe
  C:\Windows\System\oqpMkNK.exe
  2⤵
  PID:6244
- C:\Windows\System\MmuAEnv.exe
  C:\Windows\System\MmuAEnv.exe
  2⤵
  PID:7208
- C:\Windows\System\ebxEGVM.exe
  C:\Windows\System\ebxEGVM.exe
  2⤵
  PID:6816
- C:\Windows\System\wIwgFRI.exe
  C:\Windows\System\wIwgFRI.exe
  2⤵
  PID:7224
- C:\Windows\System\jRoqPEq.exe
  C:\Windows\System\jRoqPEq.exe
  2⤵
  PID:7284
- C:\Windows\System\SwiOxwS.exe
  C:\Windows\System\SwiOxwS.exe
  2⤵
  PID:7268
- C:\Windows\System\ESMwajh.exe
  C:\Windows\System\ESMwajh.exe
  2⤵
  PID:7484
- C:\Windows\System\IRUNSSk.exe
  C:\Windows\System\IRUNSSk.exe
  2⤵
  PID:7492
- C:\Windows\System\tqKiGOC.exe
  C:\Windows\System\tqKiGOC.exe
  2⤵
  PID:7536
- C:\Windows\System\qSQzGdO.exe
  C:\Windows\System\qSQzGdO.exe
  2⤵
  PID:7556
- C:\Windows\System\DzuzlYB.exe
  C:\Windows\System\DzuzlYB.exe
  2⤵
  PID:7580
- C:\Windows\System\dzVnuhO.exe
  C:\Windows\System\dzVnuhO.exe
  2⤵
  PID:7800
- C:\Windows\System\FKCQHtT.exe
  C:\Windows\System\FKCQHtT.exe
  2⤵
  PID:7864
- C:\Windows\System\pXXZivG.exe
  C:\Windows\System\pXXZivG.exe
  2⤵
  PID:7932
- C:\Windows\System\FjoTsIV.exe
  C:\Windows\System\FjoTsIV.exe
  2⤵
  PID:7996
- C:\Windows\System\SnFaKYh.exe
  C:\Windows\System\SnFaKYh.exe
  2⤵
  PID:7816
- C:\Windows\System\zpbdqBE.exe
  C:\Windows\System\zpbdqBE.exe
  2⤵
  PID:7884
- C:\Windows\System\JmYkFBX.exe
  C:\Windows\System\JmYkFBX.exe
  2⤵
  PID:7948
- C:\Windows\System\VpvIhdd.exe
  C:\Windows\System\VpvIhdd.exe
  2⤵
  PID:8012
- C:\Windows\System\hoMMnah.exe
  C:\Windows\System\hoMMnah.exe
  2⤵
  PID:8092
- C:\Windows\System\npcXmsl.exe
  C:\Windows\System\npcXmsl.exe
  2⤵
  PID:8164
- C:\Windows\System\SxVOctn.exe
  C:\Windows\System\SxVOctn.exe
  2⤵
  PID:8016
- C:\Windows\System\OjDZqGS.exe
  C:\Windows\System\OjDZqGS.exe
  2⤵
  PID:8112
- C:\Windows\System\weswgxE.exe
  C:\Windows\System\weswgxE.exe
  2⤵
  PID:8152
- C:\Windows\System\cnmYyEw.exe
  C:\Windows\System\cnmYyEw.exe
  2⤵
  PID:7112
- C:\Windows\System\tYuSALt.exe
  C:\Windows\System\tYuSALt.exe
  2⤵
  PID:7280
- C:\Windows\System\CLjdLSm.exe
  C:\Windows\System\CLjdLSm.exe
  2⤵
  PID:6820
- C:\Windows\System\NahSYdH.exe
  C:\Windows\System\NahSYdH.exe
  2⤵
  PID:7192
- C:\Windows\System\TszXLWf.exe
  C:\Windows\System\TszXLWf.exe
  2⤵
  PID:7348
- C:\Windows\System\cgpDrFY.exe
  C:\Windows\System\cgpDrFY.exe
  2⤵
  PID:7364
- C:\Windows\System\mfiMDqR.exe
  C:\Windows\System\mfiMDqR.exe
  2⤵
  PID:7408
- C:\Windows\System\JzSFSqa.exe
  C:\Windows\System\JzSFSqa.exe
  2⤵
  PID:7428
- C:\Windows\System\jpYfwoe.exe
  C:\Windows\System\jpYfwoe.exe
  2⤵
  PID:7476
- C:\Windows\System\TZCyUcU.exe
  C:\Windows\System\TZCyUcU.exe
  2⤵
  PID:7544
- C:\Windows\System\yQmdKrF.exe
  C:\Windows\System\yQmdKrF.exe
  2⤵
  PID:7588
- C:\Windows\System\iekpgdx.exe
  C:\Windows\System\iekpgdx.exe
  2⤵
  PID:7512
- C:\Windows\System\ZzshDDP.exe
  C:\Windows\System\ZzshDDP.exe
  2⤵
  PID:7572
- C:\Windows\System\gKGfIpA.exe
  C:\Windows\System\gKGfIpA.exe
  2⤵
  PID:7628
- C:\Windows\System\OgsEpWp.exe
  C:\Windows\System\OgsEpWp.exe
  2⤵
  PID:7660
- C:\Windows\System\lUxxrvg.exe
  C:\Windows\System\lUxxrvg.exe
  2⤵
  PID:7740
- C:\Windows\System\unhUTgY.exe
  C:\Windows\System\unhUTgY.exe
  2⤵
  PID:7680
- C:\Windows\System\GYSuqkv.exe
  C:\Windows\System\GYSuqkv.exe
  2⤵
  PID:7728
- C:\Windows\System\vbKHCJU.exe
  C:\Windows\System\vbKHCJU.exe
  2⤵
  PID:7760
- C:\Windows\System\kyURldC.exe
  C:\Windows\System\kyURldC.exe
  2⤵
  PID:7968
- C:\Windows\System\fCVlqEm.exe
  C:\Windows\System\fCVlqEm.exe
  2⤵
  PID:7848
- C:\Windows\System\BMorxZV.exe
  C:\Windows\System\BMorxZV.exe
  2⤵
  PID:8096
- C:\Windows\System\dfFOZOb.exe
  C:\Windows\System\dfFOZOb.exe
  2⤵
  PID:8188
- C:\Windows\System\cSWiCcz.exe
  C:\Windows\System\cSWiCcz.exe
  2⤵
  PID:7316
- C:\Windows\System\OXvsZaK.exe
  C:\Windows\System\OXvsZaK.exe
  2⤵
  PID:8148
- C:\Windows\System\vCqSMOP.exe
  C:\Windows\System\vCqSMOP.exe
  2⤵
  PID:7332
- C:\Windows\System\pNnSkRL.exe
  C:\Windows\System\pNnSkRL.exe
  2⤵
  PID:8064
- C:\Windows\System\cmPlHyR.exe
  C:\Windows\System\cmPlHyR.exe
  2⤵
  PID:7444
- C:\Windows\System\QrGcUBx.exe
  C:\Windows\System\QrGcUBx.exe
  2⤵
  PID:6796
- C:\Windows\System\AWKEuHb.exe
  C:\Windows\System\AWKEuHb.exe
  2⤵
  PID:7564
- C:\Windows\System\SrZMNlJ.exe
  C:\Windows\System\SrZMNlJ.exe
  2⤵
  PID:7612
- C:\Windows\System\gXgYwOn.exe
  C:\Windows\System\gXgYwOn.exe
  2⤵
  PID:7724
- C:\Windows\System\nINbWhr.exe
  C:\Windows\System\nINbWhr.exe
  2⤵
  PID:7980
- C:\Windows\System\sQdaFPp.exe
  C:\Windows\System\sQdaFPp.exe
  2⤵
  PID:7380
- C:\Windows\System\FtTiCnv.exe
  C:\Windows\System\FtTiCnv.exe
  2⤵
  PID:8144
- C:\Windows\System\yafodaU.exe
  C:\Windows\System\yafodaU.exe
  2⤵
  PID:7412
- C:\Windows\System\gVkccey.exe
  C:\Windows\System\gVkccey.exe
  2⤵
  PID:7664
- C:\Windows\System\zPMoGzD.exe
  C:\Windows\System\zPMoGzD.exe
  2⤵
  PID:7904
- C:\Windows\System\TCtQouV.exe
  C:\Windows\System\TCtQouV.exe
  2⤵
  PID:8080
- C:\Windows\System\yOxbUgA.exe
  C:\Windows\System\yOxbUgA.exe
  2⤵
  PID:8212
- C:\Windows\System\vklvwhA.exe
  C:\Windows\System\vklvwhA.exe
  2⤵
  PID:8228
- C:\Windows\System\pAchPiF.exe
  C:\Windows\System\pAchPiF.exe
  2⤵
  PID:8244
- C:\Windows\System\eGVwbvG.exe
  C:\Windows\System\eGVwbvG.exe
  2⤵
  PID:8260
- C:\Windows\System\qkFSzCv.exe
  C:\Windows\System\qkFSzCv.exe
  2⤵
  PID:8276
- C:\Windows\System\axsIkbw.exe
  C:\Windows\System\axsIkbw.exe
  2⤵
  PID:8292
- C:\Windows\System\TDlptyQ.exe
  C:\Windows\System\TDlptyQ.exe
  2⤵
  PID:8308
- C:\Windows\System\lcGUfsi.exe
  C:\Windows\System\lcGUfsi.exe
  2⤵
  PID:8324
- C:\Windows\System\XiOcdTT.exe
  C:\Windows\System\XiOcdTT.exe
  2⤵
  PID:8340
- C:\Windows\System\NxeZOth.exe
  C:\Windows\System\NxeZOth.exe
  2⤵
  PID:8356
- C:\Windows\System\bEXhxeC.exe
  C:\Windows\System\bEXhxeC.exe
  2⤵
  PID:8372
- C:\Windows\System\WLHAhNm.exe
  C:\Windows\System\WLHAhNm.exe
  2⤵
  PID:8544
- C:\Windows\System\rhWfXwn.exe
  C:\Windows\System\rhWfXwn.exe
  2⤵
  PID:8560
- C:\Windows\System\deWXKxe.exe
  C:\Windows\System\deWXKxe.exe
  2⤵
  PID:8576
- C:\Windows\System\OCZQFMc.exe
  C:\Windows\System\OCZQFMc.exe
  2⤵
  PID:8592
- C:\Windows\System\FEUcATF.exe
  C:\Windows\System\FEUcATF.exe
  2⤵
  PID:8608
- C:\Windows\System\fauoamX.exe
  C:\Windows\System\fauoamX.exe
  2⤵
  PID:8628
- C:\Windows\System\EYoDeCo.exe
  C:\Windows\System\EYoDeCo.exe
  2⤵
  PID:8644
- C:\Windows\System\fKshgaq.exe
  C:\Windows\System\fKshgaq.exe
  2⤵
  PID:8660
- C:\Windows\System\XzTkcbn.exe
  C:\Windows\System\XzTkcbn.exe
  2⤵
  PID:8696
- C:\Windows\System\fHMCUra.exe
  C:\Windows\System\fHMCUra.exe
  2⤵
  PID:8712
- C:\Windows\System\FWiTlgi.exe
  C:\Windows\System\FWiTlgi.exe
  2⤵
  PID:8728
- C:\Windows\System\JZhVZRg.exe
  C:\Windows\System\JZhVZRg.exe
  2⤵
  PID:8744
- C:\Windows\System\PbXURJT.exe
  C:\Windows\System\PbXURJT.exe
  2⤵
  PID:8764
- C:\Windows\System\EAluqIv.exe
  C:\Windows\System\EAluqIv.exe
  2⤵
  PID:8780
- C:\Windows\System\PMfHQqb.exe
  C:\Windows\System\PMfHQqb.exe
  2⤵
  PID:8796
- C:\Windows\System\oIBcbnc.exe
  C:\Windows\System\oIBcbnc.exe
  2⤵
  PID:8812
- C:\Windows\System\YdrmQqS.exe
  C:\Windows\System\YdrmQqS.exe
  2⤵
  PID:8828
- C:\Windows\System\ySvdnyn.exe
  C:\Windows\System\ySvdnyn.exe
  2⤵
  PID:8844
- C:\Windows\System\cxeNuNH.exe
  C:\Windows\System\cxeNuNH.exe
  2⤵
  PID:8860
- C:\Windows\System\waVNMcO.exe
  C:\Windows\System\waVNMcO.exe
  2⤵
  PID:8876
- C:\Windows\System\BZnwcqA.exe
  C:\Windows\System\BZnwcqA.exe
  2⤵
  PID:8892
- C:\Windows\System\JMmGwxF.exe
  C:\Windows\System\JMmGwxF.exe
  2⤵
  PID:8908
- C:\Windows\System\cXedPJo.exe
  C:\Windows\System\cXedPJo.exe
  2⤵
  PID:8924
- C:\Windows\System\IUXLERj.exe
  C:\Windows\System\IUXLERj.exe
  2⤵
  PID:8940
- C:\Windows\System\JQuBskl.exe
  C:\Windows\System\JQuBskl.exe
  2⤵
  PID:8956
- C:\Windows\System\LqZNdAI.exe
  C:\Windows\System\LqZNdAI.exe
  2⤵
  PID:8972
- C:\Windows\System\deGtvyA.exe
  C:\Windows\System\deGtvyA.exe
  2⤵
  PID:9092
- C:\Windows\System\vhQyTAi.exe
  C:\Windows\System\vhQyTAi.exe
  2⤵
  PID:9108
- C:\Windows\System\kYrkgzI.exe
  C:\Windows\System\kYrkgzI.exe
  2⤵
  PID:9124
- C:\Windows\System\sqvLvVv.exe
  C:\Windows\System\sqvLvVv.exe
  2⤵
  PID:9140
- C:\Windows\System\ukGYtrd.exe
  C:\Windows\System\ukGYtrd.exe
  2⤵
  PID:9156
- C:\Windows\System\VFTCIpb.exe
  C:\Windows\System\VFTCIpb.exe
  2⤵
  PID:9176
- C:\Windows\System\QygGtWT.exe
  C:\Windows\System\QygGtWT.exe
  2⤵
  PID:9196
- C:\Windows\System\jfSBjWg.exe
  C:\Windows\System\jfSBjWg.exe
  2⤵
  PID:9212
- C:\Windows\System\nbBnNbm.exe
  C:\Windows\System\nbBnNbm.exe
  2⤵
  PID:7788
- C:\Windows\System\OuTblkR.exe
  C:\Windows\System\OuTblkR.exe
  2⤵
  PID:7344
- C:\Windows\System\QsdaZys.exe
  C:\Windows\System\QsdaZys.exe
  2⤵
  PID:7872
- C:\Windows\System\iBBmtqo.exe
  C:\Windows\System\iBBmtqo.exe
  2⤵
  PID:8252
- C:\Windows\System\imCJZFD.exe
  C:\Windows\System\imCJZFD.exe
  2⤵
  PID:8348
- C:\Windows\System\MfSPESE.exe
  C:\Windows\System\MfSPESE.exe
  2⤵
  PID:7920
- C:\Windows\System\LhwWDBe.exe
  C:\Windows\System\LhwWDBe.exe
  2⤵
  PID:7712
- C:\Windows\System\JpSqKwe.exe
  C:\Windows\System\JpSqKwe.exe
  2⤵
  PID:8236
- C:\Windows\System\LbyeidS.exe
  C:\Windows\System\LbyeidS.exe
  2⤵
  PID:8300
- C:\Windows\System\BaptWMI.exe
  C:\Windows\System\BaptWMI.exe
  2⤵
  PID:8384
- C:\Windows\System\Xllzikt.exe
  C:\Windows\System\Xllzikt.exe
  2⤵
  PID:7596
- C:\Windows\System\UGxlzrY.exe
  C:\Windows\System\UGxlzrY.exe
  2⤵
  PID:8404
- C:\Windows\System\jHkGJCU.exe
  C:\Windows\System\jHkGJCU.exe
  2⤵
  PID:8428
- C:\Windows\System\AIuCHjb.exe
  C:\Windows\System\AIuCHjb.exe
  2⤵
  PID:8528
- C:\Windows\System\zHSxBne.exe
  C:\Windows\System\zHSxBne.exe
  2⤵
  PID:8568
- C:\Windows\System\BkXoOTi.exe
  C:\Windows\System\BkXoOTi.exe
  2⤵
  PID:8636
- C:\Windows\System\aYvyIPP.exe
  C:\Windows\System\aYvyIPP.exe
  2⤵
  PID:8680
- C:\Windows\System\ovpTIhv.exe
  C:\Windows\System\ovpTIhv.exe
  2⤵
  PID:8588
- C:\Windows\System\IZpiAXx.exe
  C:\Windows\System\IZpiAXx.exe
  2⤵
  PID:8652
- C:\Windows\System\cZPlVHS.exe
  C:\Windows\System\cZPlVHS.exe
  2⤵
  PID:8720
- C:\Windows\System\PmPAHzK.exe
  C:\Windows\System\PmPAHzK.exe
  2⤵
  PID:8820
- C:\Windows\System\mhpGIyB.exe
  C:\Windows\System\mhpGIyB.exe
  2⤵
  PID:8884
- C:\Windows\System\tnlLuZT.exe
  C:\Windows\System\tnlLuZT.exe
  2⤵
  PID:8948
- C:\Windows\System\BkkCnir.exe
  C:\Windows\System\BkkCnir.exe
  2⤵
  PID:8996
- C:\Windows\System\zolSPKr.exe
  C:\Windows\System\zolSPKr.exe
  2⤵
  PID:9008
- C:\Windows\System\teurQbx.exe
  C:\Windows\System\teurQbx.exe
  2⤵
  PID:9032
- C:\Windows\System\InvVogr.exe
  C:\Windows\System\InvVogr.exe
  2⤵
  PID:9048
- C:\Windows\System\udMHlAX.exe
  C:\Windows\System\udMHlAX.exe
  2⤵
  PID:9072
- C:\Windows\System\ONYdAzs.exe
  C:\Windows\System\ONYdAzs.exe
  2⤵
  PID:8808
- C:\Windows\System\PUOeNXp.exe
  C:\Windows\System\PUOeNXp.exe
  2⤵
  PID:9080
- C:\Windows\System\xVzlDjV.exe
  C:\Windows\System\xVzlDjV.exe
  2⤵
  PID:9116
- C:\Windows\System\DkZAPhz.exe
  C:\Windows\System\DkZAPhz.exe
  2⤵
  PID:9184
- C:\Windows\System\JdGuDLG.exe
  C:\Windows\System\JdGuDLG.exe
  2⤵
  PID:6176
- C:\Windows\System\MalQTTe.exe
  C:\Windows\System\MalQTTe.exe
  2⤵
  PID:8320
- C:\Windows\System\XOfknYS.exe
  C:\Windows\System\XOfknYS.exe
  2⤵
  PID:8268
- C:\Windows\System\rBPPfIL.exe
  C:\Windows\System\rBPPfIL.exe
  2⤵
  PID:8420
- C:\Windows\System\bXqmeeh.exe
  C:\Windows\System\bXqmeeh.exe
  2⤵
  PID:8740
- C:\Windows\System\okVEkMg.exe
  C:\Windows\System\okVEkMg.exe
  2⤵
  PID:8836
- C:\Windows\System\FZgUvOI.exe
  C:\Windows\System\FZgUvOI.exe
  2⤵
  PID:8900
- C:\Windows\System\mSiyDnm.exe
  C:\Windows\System\mSiyDnm.exe
  2⤵
  PID:8968
- C:\Windows\System\GhpPecS.exe
  C:\Windows\System\GhpPecS.exe
  2⤵
  PID:8204
- C:\Windows\System\VanNxHs.exe
  C:\Windows\System\VanNxHs.exe
  2⤵
  PID:8336
- C:\Windows\System\tUtlcol.exe
  C:\Windows\System\tUtlcol.exe
  2⤵
  PID:8456
- C:\Windows\System\PlDXqXF.exe
  C:\Windows\System\PlDXqXF.exe
  2⤵
  PID:8468
- C:\Windows\System\vqDrMWG.exe
  C:\Windows\System\vqDrMWG.exe
  2⤵
  PID:8480
- C:\Windows\System\TzEtUQN.exe
  C:\Windows\System\TzEtUQN.exe
  2⤵
  PID:8500
- C:\Windows\System\IHobKHr.exe
  C:\Windows\System\IHobKHr.exe
  2⤵
  PID:8512
- C:\Windows\System\drPGdZM.exe
  C:\Windows\System\drPGdZM.exe
  2⤵
  PID:8540
- C:\Windows\System\laYveUx.exe
  C:\Windows\System\laYveUx.exe
  2⤵
  PID:8584
- C:\Windows\System\BUzlEas.exe
  C:\Windows\System\BUzlEas.exe
  2⤵
  PID:8760
- C:\Windows\System\toKaItk.exe
  C:\Windows\System\toKaItk.exe
  2⤵
  PID:8620
- C:\Windows\System\hydibly.exe
  C:\Windows\System\hydibly.exe
  2⤵
  PID:7984
- C:\Windows\System\rFzkGlp.exe
  C:\Windows\System\rFzkGlp.exe
  2⤵
  PID:8980
- C:\Windows\System\AytsZbs.exe
  C:\Windows\System\AytsZbs.exe
  2⤵
  PID:8932
- C:\Windows\System\ATywzwr.exe
  C:\Windows\System\ATywzwr.exe
  2⤵
  PID:7692
- C:\Windows\System\ZKTwxZI.exe
  C:\Windows\System\ZKTwxZI.exe
  2⤵
  PID:8776
- C:\Windows\System\IZspIBy.exe
  C:\Windows\System\IZspIBy.exe
  2⤵
  PID:8332
- C:\Windows\System\EMIGhSX.exe
  C:\Windows\System\EMIGhSX.exe
  2⤵
  PID:8460
- C:\Windows\System\IdpGHCz.exe
  C:\Windows\System\IdpGHCz.exe
  2⤵
  PID:8488
- C:\Windows\System\ByWqPJx.exe
  C:\Windows\System\ByWqPJx.exe
  2⤵
  PID:9016
- C:\Windows\System\MiZNpYK.exe
  C:\Windows\System\MiZNpYK.exe
  2⤵
  PID:8752
- C:\Windows\System\bRkNGbl.exe
  C:\Windows\System\bRkNGbl.exe
  2⤵
  PID:8496
- C:\Windows\System\UkTdpUu.exe
  C:\Windows\System\UkTdpUu.exe
  2⤵
  PID:8668
- C:\Windows\System\HoGXdPn.exe
  C:\Windows\System\HoGXdPn.exe
  2⤵
  PID:8916
- C:\Windows\System\Dbleefn.exe
  C:\Windows\System\Dbleefn.exe
  2⤵
  PID:9040
- C:\Windows\System\hgUodTR.exe
  C:\Windows\System\hgUodTR.exe
  2⤵
  PID:9192
- C:\Windows\System\wLCIDpg.exe
  C:\Windows\System\wLCIDpg.exe
  2⤵
  PID:8448
- C:\Windows\System\YyUaIMQ.exe
  C:\Windows\System\YyUaIMQ.exe
  2⤵
  PID:8708
- C:\Windows\System\vqsKISr.exe
  C:\Windows\System\vqsKISr.exe
  2⤵
  PID:9056
- C:\Windows\System\FTXeACv.exe
  C:\Windows\System\FTXeACv.exe
  2⤵
  PID:9068
- C:\Windows\System\VLBWASM.exe
  C:\Windows\System\VLBWASM.exe
  2⤵
  PID:8464
- C:\Windows\System\jFPVVZL.exe
  C:\Windows\System\jFPVVZL.exe
  2⤵
  PID:8432
- C:\Windows\System\OuCkWBN.exe
  C:\Windows\System\OuCkWBN.exe
  2⤵
  PID:8688
- C:\Windows\System\YLCYhoB.exe
  C:\Windows\System\YLCYhoB.exe
  2⤵
  PID:9004
- C:\Windows\System\JssJDlY.exe
  C:\Windows\System\JssJDlY.exe
  2⤵
  PID:8788
- C:\Windows\System\iESqTwv.exe
  C:\Windows\System\iESqTwv.exe
  2⤵
  PID:8704
- C:\Windows\System\QLwTPGR.exe
  C:\Windows\System\QLwTPGR.exe
  2⤵
  PID:8388
- C:\Windows\System\UCeViMf.exe
  C:\Windows\System\UCeViMf.exe
  2⤵
  PID:7736
- C:\Windows\System\JAAwlFj.exe
  C:\Windows\System\JAAwlFj.exe
  2⤵
  PID:8604
- C:\Windows\System\oUYVlWQ.exe
  C:\Windows\System\oUYVlWQ.exe
  2⤵
  PID:9060
- C:\Windows\System\meSMkZi.exe
  C:\Windows\System\meSMkZi.exe
  2⤵
  PID:9000
- C:\Windows\System\CfAMuKH.exe
  C:\Windows\System\CfAMuKH.exe
  2⤵
  PID:9064
- C:\Windows\System\zQXzznp.exe
  C:\Windows\System\zQXzznp.exe
  2⤵
  PID:8060
- C:\Windows\System\BDofbXC.exe
  C:\Windows\System\BDofbXC.exe
  2⤵
  PID:9220
- C:\Windows\System\cNPGRAD.exe
  C:\Windows\System\cNPGRAD.exe
  2⤵
  PID:9236
- C:\Windows\System\JIrfxuU.exe
  C:\Windows\System\JIrfxuU.exe
  2⤵
  PID:9252
- C:\Windows\System\jzVCeVz.exe
  C:\Windows\System\jzVCeVz.exe
  2⤵
  PID:9268
- C:\Windows\System\tcFDDAL.exe
  C:\Windows\System\tcFDDAL.exe
  2⤵
  PID:9284
- C:\Windows\System\npRkyJZ.exe
  C:\Windows\System\npRkyJZ.exe
  2⤵
  PID:9300
- C:\Windows\System\oOCyCSr.exe
  C:\Windows\System\oOCyCSr.exe
  2⤵
  PID:9316
- C:\Windows\System\MiJcgng.exe
  C:\Windows\System\MiJcgng.exe
  2⤵
  PID:9332
- C:\Windows\System\birxKhR.exe
  C:\Windows\System\birxKhR.exe
  2⤵
  PID:9348
- C:\Windows\System\cNAPWbH.exe
  C:\Windows\System\cNAPWbH.exe
  2⤵
  PID:9364
- C:\Windows\System\DXRLOFG.exe
  C:\Windows\System\DXRLOFG.exe
  2⤵
  PID:9380
- C:\Windows\System\jfgmtau.exe
  C:\Windows\System\jfgmtau.exe
  2⤵
  PID:9396
- C:\Windows\System\wfWrqck.exe
  C:\Windows\System\wfWrqck.exe
  2⤵
  PID:9412
- C:\Windows\System\MDSAEBN.exe
  C:\Windows\System\MDSAEBN.exe
  2⤵
  PID:9428
- C:\Windows\System\bWAycdM.exe
  C:\Windows\System\bWAycdM.exe
  2⤵
  PID:9448
- C:\Windows\System\FZzAlcr.exe
  C:\Windows\System\FZzAlcr.exe
  2⤵
  PID:9464
- C:\Windows\System\ONAYpLG.exe
  C:\Windows\System\ONAYpLG.exe
  2⤵
  PID:9480
- C:\Windows\System\OvzasNK.exe
  C:\Windows\System\OvzasNK.exe
  2⤵
  PID:9496
- C:\Windows\System\UJpwxzM.exe
  C:\Windows\System\UJpwxzM.exe
  2⤵
  PID:9512
- C:\Windows\System\KlNoJZC.exe
  C:\Windows\System\KlNoJZC.exe
  2⤵
  PID:9528
- C:\Windows\System\beKgdNj.exe
  C:\Windows\System\beKgdNj.exe
  2⤵
  PID:9544
- C:\Windows\System\erfboZN.exe
  C:\Windows\System\erfboZN.exe
  2⤵
  PID:9560
- C:\Windows\System\XnzGcoV.exe
  C:\Windows\System\XnzGcoV.exe
  2⤵
  PID:9576
- C:\Windows\System\wmFnSZK.exe
  C:\Windows\System\wmFnSZK.exe
  2⤵
  PID:9592
- C:\Windows\System\ZMEESjp.exe
  C:\Windows\System\ZMEESjp.exe
  2⤵
  PID:9608
- C:\Windows\System\dwsQQaJ.exe
  C:\Windows\System\dwsQQaJ.exe
  2⤵
  PID:9624
- C:\Windows\System\clKRthx.exe
  C:\Windows\System\clKRthx.exe
  2⤵
  PID:9640
- C:\Windows\System\cjoLRgT.exe
  C:\Windows\System\cjoLRgT.exe
  2⤵
  PID:9656
- C:\Windows\System\FRuUGsk.exe
  C:\Windows\System\FRuUGsk.exe
  2⤵
  PID:9672
- C:\Windows\System\tBYQmcB.exe
  C:\Windows\System\tBYQmcB.exe
  2⤵
  PID:9688
- C:\Windows\System\niDTniO.exe
  C:\Windows\System\niDTniO.exe
  2⤵
  PID:9704
- C:\Windows\System\CAjJjXz.exe
  C:\Windows\System\CAjJjXz.exe
  2⤵
  PID:9720
- C:\Windows\System\EwkRYpN.exe
  C:\Windows\System\EwkRYpN.exe
  2⤵
  PID:9736
- C:\Windows\System\PcHZzPf.exe
  C:\Windows\System\PcHZzPf.exe
  2⤵
  PID:9752
- C:\Windows\System\uDLIUiw.exe
  C:\Windows\System\uDLIUiw.exe
  2⤵
  PID:9768
- C:\Windows\System\awlKnqD.exe
  C:\Windows\System\awlKnqD.exe
  2⤵
  PID:9784
- C:\Windows\System\PPnUgFk.exe
  C:\Windows\System\PPnUgFk.exe
  2⤵
  PID:9800
- C:\Windows\System\dRrEapX.exe
  C:\Windows\System\dRrEapX.exe
  2⤵
  PID:9820
- C:\Windows\System\StDwjKJ.exe
  C:\Windows\System\StDwjKJ.exe
  2⤵
  PID:9836
- C:\Windows\System\sLUSNnP.exe
  C:\Windows\System\sLUSNnP.exe
  2⤵
  PID:9852
- C:\Windows\System\yVsghlI.exe
  C:\Windows\System\yVsghlI.exe
  2⤵
  PID:9868
- C:\Windows\System\WMrYdQv.exe
  C:\Windows\System\WMrYdQv.exe
  2⤵
  PID:9884
- C:\Windows\System\YfJvKmR.exe
  C:\Windows\System\YfJvKmR.exe
  2⤵
  PID:9900
- C:\Windows\System\stOXfnG.exe
  C:\Windows\System\stOXfnG.exe
  2⤵
  PID:9916
- C:\Windows\System\ACQveCp.exe
  C:\Windows\System\ACQveCp.exe
  2⤵
  PID:9932
- C:\Windows\System\VOlIULX.exe
  C:\Windows\System\VOlIULX.exe
  2⤵
  PID:9948
- C:\Windows\System\ISQnAUx.exe
  C:\Windows\System\ISQnAUx.exe
  2⤵
  PID:9964
- C:\Windows\System\dFeMxGh.exe
  C:\Windows\System\dFeMxGh.exe
  2⤵
  PID:9980
- C:\Windows\System\kKIadEV.exe
  C:\Windows\System\kKIadEV.exe
  2⤵
  PID:9996
- C:\Windows\System\tqzeCOo.exe
  C:\Windows\System\tqzeCOo.exe
  2⤵
  PID:10012
- C:\Windows\System\lpgGuPY.exe
  C:\Windows\System\lpgGuPY.exe
  2⤵
  PID:10028
- C:\Windows\System\dMtCZAw.exe
  C:\Windows\System\dMtCZAw.exe
  2⤵
  PID:10044
- C:\Windows\System\ixaifUs.exe
  C:\Windows\System\ixaifUs.exe
  2⤵
  PID:10060
- C:\Windows\System\nPrtuvy.exe
  C:\Windows\System\nPrtuvy.exe
  2⤵
  PID:10076
- C:\Windows\System\YtlEMii.exe
  C:\Windows\System\YtlEMii.exe
  2⤵
  PID:10092
- C:\Windows\System\JIqUyyU.exe
  C:\Windows\System\JIqUyyU.exe
  2⤵
  PID:10108
- C:\Windows\System\chwLMPI.exe
  C:\Windows\System\chwLMPI.exe
  2⤵
  PID:10124
- C:\Windows\System\WwbhYNq.exe
  C:\Windows\System\WwbhYNq.exe
  2⤵
  PID:10140
- C:\Windows\System\TPzrqyK.exe
  C:\Windows\System\TPzrqyK.exe
  2⤵
  PID:10156
- C:\Windows\System\SvPuHPF.exe
  C:\Windows\System\SvPuHPF.exe
  2⤵
  PID:10172
- C:\Windows\System\pYgAIjn.exe
  C:\Windows\System\pYgAIjn.exe
  2⤵
  PID:10188
- C:\Windows\System\pLxVJTX.exe
  C:\Windows\System\pLxVJTX.exe
  2⤵
  PID:10204
- C:\Windows\System\hMRGqmb.exe
  C:\Windows\System\hMRGqmb.exe
  2⤵
  PID:10220
- C:\Windows\System\eIDNOek.exe
  C:\Windows\System\eIDNOek.exe
  2⤵
  PID:10236
- C:\Windows\System\REJlKjo.exe
  C:\Windows\System\REJlKjo.exe
  2⤵
  PID:9260
- C:\Windows\System\ykJWaHt.exe
  C:\Windows\System\ykJWaHt.exe
  2⤵
  PID:8508
- C:\Windows\System\AipjUjI.exe
  C:\Windows\System\AipjUjI.exe
  2⤵
  PID:8672
- C:\Windows\System\MCopjAE.exe
  C:\Windows\System\MCopjAE.exe
  2⤵
  PID:9280
- C:\Windows\System\bGxeaem.exe
  C:\Windows\System\bGxeaem.exe
  2⤵
  PID:9388
- C:\Windows\System\DdNxnxw.exe
  C:\Windows\System\DdNxnxw.exe
  2⤵
  PID:9456
- C:\Windows\System\hzTTksh.exe
  C:\Windows\System\hzTTksh.exe
  2⤵
  PID:9312
- C:\Windows\System\dCWooYm.exe
  C:\Windows\System\dCWooYm.exe
  2⤵
  PID:9344
- C:\Windows\System\bPlSQMO.exe
  C:\Windows\System\bPlSQMO.exe
  2⤵
  PID:9436
- C:\Windows\System\rRebgOW.exe
  C:\Windows\System\rRebgOW.exe
  2⤵
  PID:9476
- C:\Windows\System\mcQXtgd.exe
  C:\Windows\System\mcQXtgd.exe
  2⤵
  PID:9524
- C:\Windows\System\bXIqtBZ.exe
  C:\Windows\System\bXIqtBZ.exe
  2⤵
  PID:9556
- C:\Windows\System\FgZroDQ.exe
  C:\Windows\System\FgZroDQ.exe
  2⤵
  PID:9600
- C:\Windows\System\qDqivXB.exe
  C:\Windows\System\qDqivXB.exe
  2⤵
  PID:9620
- C:\Windows\System\PTcmkFW.exe
  C:\Windows\System\PTcmkFW.exe
  2⤵
  PID:9744
- C:\Windows\System\lsGXjzP.exe
  C:\Windows\System\lsGXjzP.exe
  2⤵
  PID:9848
- C:\Windows\System\EpeOgvO.exe
  C:\Windows\System\EpeOgvO.exe
  2⤵
  PID:9912
- C:\Windows\System\LAZlSuz.exe
  C:\Windows\System\LAZlSuz.exe
  2⤵
  PID:9636
- C:\Windows\System\LAqXraS.exe
  C:\Windows\System\LAqXraS.exe
  2⤵
  PID:9700
- C:\Windows\System\GriQDlb.exe
  C:\Windows\System\GriQDlb.exe
  2⤵
  PID:9792
- C:\Windows\System\lGwbbqM.exe
  C:\Windows\System\lGwbbqM.exe
  2⤵
  PID:9924
- C:\Windows\System\Jopqzih.exe
  C:\Windows\System\Jopqzih.exe
  2⤵
  PID:9860
- C:\Windows\System\lNxZKfO.exe
  C:\Windows\System\lNxZKfO.exe
  2⤵
  PID:9976
- C:\Windows\System\IErjXIw.exe
  C:\Windows\System\IErjXIw.exe
  2⤵
  PID:9988
- C:\Windows\System\SaeUsDP.exe
  C:\Windows\System\SaeUsDP.exe
  2⤵
  PID:10024
- C:\Windows\System\fLIfDLU.exe
  C:\Windows\System\fLIfDLU.exe
  2⤵
  PID:10068
- C:\Windows\System\whlejrG.exe
  C:\Windows\System\whlejrG.exe
  2⤵
  PID:10104
- C:\Windows\System\mRxMlLV.exe
  C:\Windows\System\mRxMlLV.exe
  2⤵
  PID:10136
- C:\Windows\System\uzCAGdZ.exe
  C:\Windows\System\uzCAGdZ.exe
  2⤵
  PID:10180
- C:\Windows\System\DvftMNA.exe
  C:\Windows\System\DvftMNA.exe
  2⤵
  PID:10196
- C:\Windows\System\DhJyNZt.exe
  C:\Windows\System\DhJyNZt.exe
  2⤵
  PID:10228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DkYtTpf.exe

Filesize
1.4MB

MD5
7d04d0eac244e0ba2b1de4bbeb4346c9

SHA1
c6c291c1b54e4e72f4cdf00f34d16aac64ca3731

SHA256
0c5543281924d953ff6b7309b84cb9adcaef765476f4985846b82db2a4e2d651

SHA512
0852e524daee170e935e85d1316ed7d5fdc7f1f2bdfcb7756061ce039c1a02ba510fd3ff1b1500adf4324eb282161166e91be47bd725e0faea56f805a9cee985

Download Submit
C:\Windows\system\FhCnTxN.exe

Filesize
1.4MB

MD5
9a9004e79682b2f41fd138d96d8ab43e

SHA1
702a0cc3cbd8b2d55b5a8fcca19dec538513f2b6

SHA256
1afd5172b878d7e6a702b698966f4accd9424e456998ac6c10f4310c0cd68f87

SHA512
9323a9773f6bd068bdbfaba79877adffd102db21f1a72f8f010dfcc531a4888b74d9d0c07fff9ac2a9fccf008ff4bc2c9bae144a5e565d6a6bf57b1cccc0a9ee

Download Submit
C:\Windows\system\GvOdDnS.exe

Filesize
1.4MB

MD5
1b461d98fd746cfbfa3a06396da552d7

SHA1
8297e1b13aead7bbdde6657f5a6f2011a5f6802c

SHA256
3ab2b9d89cfab22c0abd2884b3966b718b585a4a408c561b8933f341708b33a2

SHA512
c2b7a610d03ea973802a32a5259869fcd9d9fa39fd2f06373199673d79a7a9a2a6f934e657c510b772ec082974f316a48e816674f2294d6aad59d5e4d24e3aec

Download Submit
C:\Windows\system\GxgZmSK.exe

Filesize
1.4MB

MD5
d0c331a33d58b1361e82c8dcff43afef

SHA1
7534b39a8efa258c7332d2105a6570a06b2b5b3e

SHA256
3eda47d5ce74d9fbc42034e91a4011cecd311ca2136f2557c19e96bc60d80947

SHA512
f85302b8cbe58898ed1f08bbf74ab0e099be31eac22b24ca18b23e54be235b9a00ad886f6502bc9036ae051db0bdb2b705a224f30ae0f5ec828d3645a106dea0

Download Submit
C:\Windows\system\JHywxMA.exe

Filesize
1.4MB

MD5
712672dd388836d3ead90ae9bb613776

SHA1
9d90ff0688c6fb6c99e2271de7991929e9855bad

SHA256
34d03b10105f8ab532c7e54fecf5d4fd9c2643581724af465705075eb24397ec

SHA512
1cf5d6605a76fc300953ddada772036affe085e9cfcb55f39b98ddb25821b1eb893c53b459bb9683d910ff8be0bef12f146c35fbdb3a1da885a3c8e0bd916813

Download Submit
C:\Windows\system\KOOZxkz.exe

Filesize
1.4MB

MD5
4fd0e3f8168e28d8a2a64ac53efd740d

SHA1
f8ff7744e86d7bbdc6185d5d90ec755c0d2bc3a3

SHA256
94271004708e4b430b1f1b752aecde8799e0b5ec1d7568314451f1135a2add08

SHA512
eaf55f19c68e0c7c36a8d1d03c82d96ea038527ba8d12755df44daab618ef2d1b76e8084d4b9c5a420b399fdc37cbd891ff0c963a9158ebd38212b9640ba65f3

Download Submit
C:\Windows\system\LhubNSd.exe

Filesize
1.4MB

MD5
cc132111b4b0a295e04f42737e852aed

SHA1
a53d48cbc6e700811ec771490a0c9ddce4d26a08

SHA256
76d15cfd8b335684b5e9d3de5be35f17716a130d132a70d2c9214baed54bd6bb

SHA512
bbebadfe9f980d46bc5ff260e7c1279599cd09c582d9d9e7c45adedef85c271204e5e4b5b4e489a12c5393541b6799831b75bf0d301bbca03871505e109f46f0

Download Submit
C:\Windows\system\TArCfUw.exe

Filesize
1.4MB

MD5
e94f9f1f33e7e716a5225029dbb6dab4

SHA1
a9f41315f9a5d49815386bd9e36201e714f9a5a6

SHA256
11c3f34551d1f015569fcacb9b57aa524aab6e17a54685f998e9d073e17be13a

SHA512
6ad633168139944eeed0b30f128aaa86a25cab9d9eed5b40f9407bbe3f150ea74fe0e37fb3228fd5b97ee0b9e7cf28ca853f72abb3d55b57b96d15bf3e145c9b

Download Submit
C:\Windows\system\VRYiUOv.exe

Filesize
1.4MB

MD5
4ec781230a04fc5a4f394e2c6ac691b9

SHA1
777571849086ffef953e07fc4e7aab40c2b2bcdb

SHA256
0f6d6a74571b893be4a50aee7c0123ac790b98905cbf6e97dcbc04156e57517e

SHA512
93633ba7d179799ed45819ed6192683dcfa61f9d77728ac7c986e3c0fb650146f3306e26fa1484523d6fcd6c3f7e9528b61a1a665847586b97662929bc8d33b3

Download Submit
C:\Windows\system\XVIJpSI.exe

Filesize
1.4MB

MD5
0ffd59202cb664e9688c9e6453bfeaac

SHA1
255394c3bd60ee815e165daee01829dfaae78e22

SHA256
efd6611ae0b61028afaf08159597540e77ef0ee89f98ce8b3f5f144038bb59ab

SHA512
ca89763e4f56b3d9efb4c8182f637a85b68f80cde11ef601bba7bc16dd057d3c5828159dc47e0a99035daf981734d722a871795676b42ef391b7700814967a58

Download Submit
C:\Windows\system\YATVlXk.exe

Filesize
1.4MB

MD5
12336e2440c290796933cdf381ed7ad5

SHA1
4f9d5a68b1c700ef1821c846d7f8dae108f15542

SHA256
81a0f5bfc3743b10682054b0543ac220c86be6cd584a10df0e8d3dcea6307b2b

SHA512
e0b380812edc81d4f1cc1ae11feb424eebff775d931ba282d5b7e29c17e16230bec7bd2c7f88f92b699f8761d65439c399a2fed851211d847a7ff3f324ef5035

Download Submit
C:\Windows\system\YkmKWLs.exe

Filesize
1.4MB

MD5
482e86c8a3f3f2ba7a1e97ff4ebb1fbf

SHA1
21b0ce2c5ab492397ad7f0b0684a6deb19775e05

SHA256
c1ba9377e658b9a5c6a7a1e4fa3ad8006b1b9d4a5ad08157e51b9ab9d14c2ae8

SHA512
b2057e657a80376c85665a372cc31335334ed17c778a9101cebf4105136013f597269d3156c0b58fcd4238a09b7d5aa8f6b308fa4eee8d764ac232194bffe488

Download Submit
C:\Windows\system\fWHhFaA.exe

Filesize
1.4MB

MD5
cd9c03691262c30fe860f7df2fcc7df0

SHA1
ececacd95a1c5370eaa8fa57358f7f679d7d0ced

SHA256
e98a716ac550ba5c7a3003c471f134d537b8febb2376cfcd3baad5b53eab129f

SHA512
af3818090b77b556ed0f3bd229dd552bb2a0e1de3bccf80a378e220058f0fac5fa27316a8ac54d3ded6125b0d2c2b54745f9530276555db10660d88d8e31241d

Download Submit
C:\Windows\system\gbiMtkM.exe

Filesize
1.4MB

MD5
afec99ad5c91e3c330fc1c4ed8d2c78e

SHA1
22a33bfd306c5ce4847b6367be8e6bc1451f563a

SHA256
919de8ac90d8814b1a851f2820b5aa8c35718aa480cf5da9614e45eddb06ec70

SHA512
3484f52da39e8ebfc6eb3d21ddb0d715f67f152276182f58b92f88bca599753f2234122d8ed15cbc5a0e9aa6a6d832f2813ebe5c182ca0b06d20d74ab204266a

Download Submit
C:\Windows\system\kURMJgg.exe

Filesize
1.4MB

MD5
f371e81d3011cddb30faf0ccbcd1c656

SHA1
f091e5086d054da4e6b5ee1fd30dd81447891ca7

SHA256
64f29eedf713ad2b2f21d17b87eed1bdf8c65ea69ff86fbe06f001938079ab7e

SHA512
2fa5a87ffcdcb3c45efd152eb3fe292a1859ebbd4f943cd685de299fc904218551a0266bda755a3f0342939e7fdd1eedcbf6ec86a5c507ef35e6d2b1e4a2422a

Download Submit
C:\Windows\system\nhoOWdd.exe

Filesize
1.4MB

MD5
0caa395925d6a836f5bc8462bb1b1626

SHA1
8659a441dfc68f52681a5f1e4501bc4c7c03adc9

SHA256
07fe27694fde1bbed4b5c0f5947229a0d5d97ea327252d29a8e649ce9b603f55

SHA512
2210b236992d6fa8821b343c7a65db1286dee97f7f293847f1aacbdfa1065e3e010892216d5098c3a3d356ee44a4549de5fdb049046f11de4188c9aaaa245a6a

Download Submit
C:\Windows\system\oauqBCk.exe

Filesize
1.4MB

MD5
734fbfcabbb46e11fe6249d287c34908

SHA1
ec256bfea49dcda305549c95a16b061061715574

SHA256
467fa4e02175f967146e1bafa649ee49da950552304452125a1e87e827a9ebf5

SHA512
908b5ed31486253a10a856988717e2083ea164b02c30c51d206c4b8aa686e4550490f0bc5ce75457e32780809e39331c36151ceda453b877fd0539774c53c114

Download Submit
C:\Windows\system\pRPBXAY.exe

Filesize
1.4MB

MD5
56690ae5a2d76e3c2f83f0e3de0923d3

SHA1
798dae2f41006ae7c5731d93c724521da416e226

SHA256
0f115d124c79a366e399b0fc005002ea0f413d383859a308658edaa5bc3d1929

SHA512
7d667149105497f7d85667d68d901f7f7f8908acb27a775da0c6d8373f0f091f169558bca0edc2881a048850080c38d6c439098fcff3371bf37490e6ff228511

Download Submit
C:\Windows\system\qJxsAfm.exe

Filesize
1.4MB

MD5
d4b5a4abb189a64c71bab3be8df59b99

SHA1
9b738fd17ace694d75cc5509171835350f687f57

SHA256
d6d9bc83abdbeee06674653be8b6c3d5777b892dbd6e8ec7490fcd844769c1bb

SHA512
512f5dc5b4a41775214ba1970e0fe6a377ec628a56828daf7f0ae243ba6ab8d03b9c2d4ab2edccfaf0e0ea544d97614b1eff0589924bcd1aa853faf736d3ef26

Download Submit
C:\Windows\system\qbawOXi.exe

Filesize
1.4MB

MD5
86d39ba4aad6f38bcdcf32a96d8a060e

SHA1
6eb3d55ab00e4c976c2ef180168ea3c06e4a94b1

SHA256
044c74e9ef1642d34bb923c440ba4b9dfb22855c63295aafe6c8771acbdaccc5

SHA512
f5cf249850d09df0dfe0252e269ba7e4fec150bd8d77b853e0d536527536c28dd3ca38734014b32eb2fbf34e5be90a55794ee3bdccc990e3ba33112f1aca2fbd

Download Submit
C:\Windows\system\soYFQPg.exe

Filesize
1.4MB

MD5
dc5a5bce78ce921a934b60d9e5add0ce

SHA1
5d5371b3e8c65b8d7479042042faf037bc0c9302

SHA256
07c96bfdf5b3eb4120851e625ed334c1e4d14eb68de7a8fa064203ec3eb78152

SHA512
623b16da2e67c5b7f55fa267a1b6305df7a009f0989e92dbb03e3642e813ec5be71357d880f4e1930f0b354f6233d8513b9eb85289266936e5287c1812a89a40

Download Submit
C:\Windows\system\spwanzr.exe

Filesize
1.4MB

MD5
a74e2512d0d53c403f2641fc0e46b974

SHA1
30e32a0decf14bfdc1f9a6932480884294800f5b

SHA256
7f01d16b7b5984d9c2a231cfe5d9a03ebb76a7ff29ca3619d5ae2bf3b34023db

SHA512
092e281def4868e20acd43d5ea06bb1f984971d488bc3d5c39ff4595719f98afcfba4fd3ec9620c05eb8c727f46992b9c069a98f04bb1cc07b63eb7dede75730

Download Submit
C:\Windows\system\uwrckmf.exe

Filesize
1.4MB

MD5
05cb1c081b37f966b2ab2d809a82b71b

SHA1
66382eb39739b33108ba37aec688f29b59282ebb

SHA256
4f8e9300bcf5b885eae24022c33a03656ae97316b29601c12a15cf8ac30b2934

SHA512
756c98c409761b984c5948c0fb6a1b68df0d89a975484921927c1e096fa641e16ea0ce7172ab5bd5d1265696841b86ab4c7014a45f6629101391276adcd4ee97

Download Submit
\Windows\system\APqJSGd.exe

Filesize
1.4MB

MD5
8f2e58390984f64472e320e342299da9

SHA1
7ee93a0b2e7cb28c561611eb0aef2b3c1e2e6aa5

SHA256
c344db029309e450c6ca5343dd48208ef77d573d6e0d56306598260e1c460d74

SHA512
e016c82f65df1461a111ff6f3083ca2400f926a7e1e918710addd850614c338df0136de73a64b669a5184e913cd2c0485f05a5f81dfedbd7074c77a2abdc2123

Download Submit
\Windows\system\GwNyBWv.exe

Filesize
1.4MB

MD5
31675f83f88f4c865ac8882676c3451e

SHA1
6e6b1b8296f699a1ea7a104a39b79c4ecb499a58

SHA256
49cada0be634079ac4a935bec7bc01c133a14018faf29b218ad5d4b18fb8a7e8

SHA512
00973facf24ac495c9ca06d01593b59a68d1c590863d3b677d6514b740a6765561eb646236317a8b4c904481d3457a9999dfbac0812e7f66b3d778927fba8eda

Download Submit
\Windows\system\KEItqHN.exe

Filesize
1.4MB

MD5
c5a238625d99481adf440852e9726269

SHA1
3f62bada9f87b5fd717d0946941efa32f8ca1a66

SHA256
45dea4ba50b773c0224d87587726658c66c6ec3c7b0717fa32dcf15d8966a655

SHA512
abeb2aeb3deefa943bbf9c685f71cb3b7f9e23a46680a7fa0a1774e9aae4c308110d114048ed778d32f3206cdb2a72fe5e68944f6a85592413f0887897f95ff0

Download Submit
\Windows\system\OWausfX.exe

Filesize
1.4MB

MD5
7551c932c4b3626b7642c602054a2488

SHA1
cdb99e1012c7456e1e27bb846c588a4fe1305c25

SHA256
9f8e58e3c98c7edcd0f121e110c0291a863384763cbf391434fc210e60e228b8

SHA512
3cce18ff2e0ac04a424ce9cdd9d3db58a407a55e2bf7315c73c2dcd811d7d41b27abf665709efb019680f25398ed7dbf98c45ba0310d081520eceb7720218ab6

Download Submit
\Windows\system\PSUUTtD.exe

Filesize
1.4MB

MD5
18cac3f41cfb59a4889229ad86061519

SHA1
769fc7c0886ea5d3c225e925ea9aa950ee316e40

SHA256
d8816597b7db8c71b44c76f07dfd85f0f0b1b3da65d356fe96604785af6b02b7

SHA512
6d8df2baf15039c5f7c0c2b9551d8083566282af3bd4b36a84c90005a8e2fc4f8a7462607d305a2cbaa6a8855d64a335366b314b72f2563651c7fd255f6afed5

Download Submit
\Windows\system\aqvkOvX.exe

Filesize
1.4MB

MD5
073ebacfd69d5a359d60cc62e7b8e379

SHA1
6ac5c585280f0a3d1a6b36e09f1dd533a6bd4a8e

SHA256
29be718811d885aa8ee44bd240cdf71a783050831217d97f82233d4955d2125a

SHA512
8bcfd4fc63f5519f32fc68aa59b763e6fee4568c3b4b149c674a978a29bad6e4d0886e921eac9a3851b5107f5d73c9fa1f79d5324d9e3f505f9364ae20da88d9

Download Submit
\Windows\system\hVfYgPK.exe

Filesize
1.4MB

MD5
dd381a5c3e0629ce5422731e2e01d95e

SHA1
7fba3b1e8750a5c5ec59b7871c8651ae5f8d14d7

SHA256
19f1efb4a6c4c17ca785bf5ccd6a82eb080cde9e1eb8917cdb5e504d08ef94d1

SHA512
aec8959598937de6d05dea97db4e188e0073b1ae81f9742ba49371d14c7edadb7b1c9cbde3b5b8af95dc8d8c4c80ec17c93245a1b6794fd2f2f5a9cf2f44ffef

Download Submit
\Windows\system\lSYhnYA.exe

Filesize
1.4MB

MD5
e2b2c220527605b862797343d25210f6

SHA1
4f4d2bd2d7d73f74743274c4ce557f897de0f279

SHA256
ec9655ee9639473c2df01abeb2009ac8599f93a9d45df620f05f9c8b5c7a8659

SHA512
09bd129134ef3b7bf16db13ec4ecea43476d11a24ec6ba6dbaa145128c0a0a117afed931bb359f801a4bc9a10798118fc47ba099b6541dd7cf88bd8326091cba

Download Submit
\Windows\system\uYSBXdt.exe

Filesize
1.4MB

MD5
996cb63adf990108945264496aa655c0

SHA1
cfc271187608c6784281c3e8028c3590f65be325

SHA256
fca22e104fc04dd5d4a1c279962cc383912fbdf5cc1d489a1b3b6faa4e103617

SHA512
1763f6ae224bc16217dc73e417969d1e9fc370289d8d21268245b72c181fbe47bd48f2c2302350ac91cb0e4b6754ef63d0b6961ea8413c8de1a3b10a0db4848a

Download Submit
memory/1860-124-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-13-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2152-122-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-101-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2320-113-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/2320-28-0x0000000002820000-0x00000000028A0000-memory.dmp

Filesize
512KB

Download
memory/2320-29-0x000007FEF604E000-0x000007FEF604F000-memory.dmp

Filesize
4KB

Download
memory/2320-70-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2320-302-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

Filesize
9.6MB

Download
memory/2320-131-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

Filesize
9.6MB

Download
memory/2320-91-0x000007FEF5D90000-0x000007FEF672D000-memory.dmp

Filesize
9.6MB

Download
memory/2424-114-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-116-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2472-5027-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-111-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-120-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2548-118-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-4984-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2648-27-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2712-139-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2712-100-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2712-117-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-112-0x00000000032D0000-0x00000000036C2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-119-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2712-0-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2712-14-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2712-5026-0x00000000032D0000-0x00000000036C2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2712-123-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-121-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-115-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2712-25-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2712-11-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2712-2121-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2712-102-0x00000000032D0000-0x00000000036C2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-5022-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2728-99-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/3032-16-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download