xmrig | a3dd67392096ae9a3de1a601b1aa56fa2ae151101e3e58ca0ebc3c7c459a996b

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
Size

2.1MB
MD5

11fe16c9029051d46f33568fbb908796
SHA1

9a00025d8fb82d1227d95d6cff52a5b7270e277f
SHA256

a3dd67392096ae9a3de1a601b1aa56fa2ae151101e3e58ca0ebc3c7c459a996b
SHA512

388127f6bc72fd391e713482995c05217796262c15b28b7371ce8c5a25c89a4246d63289eaff47b4e46503d8861ef6e4cb190133f9cac8b317e194835f93ccc8
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafz:NAB4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2520-9-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2396-139-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2488-111-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2408-102-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/328-138-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2856-134-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2884-127-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2456-90-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2880-86-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/1680-84-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2692-81-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2396-5339-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2760-5344-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/328-5341-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2408-5345-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2856-5347-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2456-5350-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2880-5355-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2884-5354-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2692-5348-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2488-5404-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2520-5400-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/1680-10351-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2848	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2520	KYdPPMX.exe
2760	NTOqsXs.exe
2692	AptbJte.exe
2880	LZCIwzD.exe
2456	giAcBBz.exe
2408	cMZnYWt.exe
2488	DUfmsbR.exe
2884	rWTvFnV.exe
2856	SKchegs.exe
328	FohQaIo.exe
2396	JfWlAUz.exe
1212	zjjoFqE.exe
2644	wwrQYVv.exe
2708	ucZMjiE.exe
1596	ZXqfpXB.exe
1780	xrOjbhI.exe
2172	shVMxMP.exe
1464	pxaEQzy.exe
2040	yTVhvil.exe
2144	bGQcIau.exe
2136	xogiRDd.exe
1632	eOduqYf.exe
2596	PCVHpQH.exe
580	EkqPaGC.exe
800	vhTboYn.exe
1416	eZQNDbw.exe
980	DLkCoad.exe
1000	SDWjzkE.exe
1312	BbKcIFZ.exe
108	SgEdals.exe
864	sVemCEj.exe
1476	eslptKb.exe
2960	aLuUCmZ.exe
3008	BGglnUt.exe
1608	saOoJal.exe
1824	QlPSqtd.exe
2272	IMZCGTI.exe
1700	xCidURB.exe
1580	ElGCsRP.exe
876	ClSaLFJ.exe
2268	AWxMkLo.exe
1724	NJZjGZb.exe
1620	TpAIPzi.exe
1192	VjXAOcR.exe
1256	LUXPAIV.exe
1992	CSyhWux.exe
1692	fsryvoq.exe
2000	MAFniGN.exe
1972	VwDXRMp.exe
1648	gldsPDd.exe
2600	EBLRnJM.exe
1928	VqwABVy.exe
1544	sYLXHcq.exe
2516	DCWHNzX.exe
2676	IMVAydQ.exe
2748	TxganaH.exe
2580	jNwiDdF.exe
2424	SKyzLLm.exe
2080	LoMsZAr.exe
1364	rYxjRLN.exe
2588	hZpVzdq.exe
1044	exPHKBR.exe
1600	icXgosg.exe
2024	QiSBbGg.exe

Loads dropped DLL 64 IoCs

pid	Process
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1680-1-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/files/0x000e000000012345-3.dat	upx
behavioral1/memory/2520-9-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/files/0x00300000000126ff-12.dat	upx
behavioral1/memory/2760-20-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/files/0x0008000000013129-23.dat	upx
behavioral1/files/0x001800000000558a-30.dat	upx
behavioral1/files/0x00080000000131d9-37.dat	upx
behavioral1/files/0x000a0000000133a3-48.dat	upx
behavioral1/files/0x000700000001417f-53.dat	upx
behavioral1/files/0x0006000000014323-69.dat	upx
behavioral1/files/0x00060000000143a8-85.dat	upx
behavioral1/files/0x00060000000144e0-123.dat	upx
behavioral1/files/0x00060000000144d8-132.dat	upx
behavioral1/memory/2396-139-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x00060000000149e1-163.dat	upx
behavioral1/files/0x0006000000014dae-180.dat	upx
behavioral1/files/0x0006000000014b10-168.dat	upx
behavioral1/files/0x00060000000153c7-192.dat	upx
behavioral1/files/0x0006000000014eb9-183.dat	upx
behavioral1/files/0x0006000000014ba7-179.dat	upx
behavioral1/files/0x000600000001502c-189.dat	upx
behavioral1/files/0x0006000000014b36-173.dat	upx
behavioral1/files/0x0030000000012727-158.dat	upx
behavioral1/files/0x0006000000014702-150.dat	upx
behavioral1/files/0x000600000001480e-154.dat	upx
behavioral1/files/0x0006000000014662-145.dat	upx
behavioral1/files/0x0006000000014502-144.dat	upx
behavioral1/memory/2488-111-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/files/0x000600000001448d-103.dat	upx
behavioral1/memory/2408-102-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/328-138-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2856-134-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2884-127-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/files/0x00060000000146f8-125.dat	upx
behavioral1/files/0x0006000000014588-124.dat	upx
behavioral1/files/0x0006000000014435-115.dat	upx
behavioral1/memory/2456-90-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2880-86-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2692-81-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x000600000001430c-78.dat	upx
behavioral1/files/0x000600000001431c-73.dat	upx
behavioral1/files/0x0006000000014204-72.dat	upx
behavioral1/files/0x000600000001418f-57.dat	upx
behavioral1/files/0x000900000001315b-34.dat	upx
behavioral1/memory/2396-5339-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2760-5344-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/328-5341-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2408-5345-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2856-5347-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2456-5350-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2880-5355-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2884-5354-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2692-5348-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2488-5404-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/2520-5400-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/1680-10351-0x000000013F080000-0x000000013F472000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\haOqmRh.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\HHVvTfC.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\IYVZuET.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\KzyUHpo.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\qelAlNk.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\HHlqWvB.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\BckdtlU.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\DyFyHBM.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\uBFPeAD.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\nNYnJJs.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\PGDHYrv.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\QThlLNH.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\ooSqpVb.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\AOwyIvG.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\kItpZvh.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\JemLZtT.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\vzudjdU.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\PRMOgqY.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\WOyfcFd.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\bVXnKwL.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\HRGxtYC.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\hpBcIXn.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\SPRJNWz.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\xYJtSHD.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\TuhgvEP.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\FfNiZeD.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\SgEdals.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\LPclKPc.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\aGHXqcf.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\fnDKIFX.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\CFfPKFs.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\qDziRwP.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\FwGiRxM.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\YMaUquC.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\rNjcDSm.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\uNeswJR.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\yuokkwn.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\MatGXTb.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\vNAQBNQ.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\hOLAMTU.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\oJFkfDR.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\IuQehzG.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\YUWdMIN.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\JSbWpOZ.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\XCxAyvA.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\BPerLde.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\IihbGYY.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\qBtaZwb.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\aOrTQEa.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\IfngBPq.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\YpAUiXh.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\RXezAOq.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\TyCraCb.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\PyMCAbP.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\JANyfxw.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\mfTsEIf.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\krHWwJx.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\VMIEJyL.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\zmnBTKp.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\MRmUHwe.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\HuVkxsr.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\ZFFmFLH.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\dVkvcJc.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
File created	C:\Windows\System\NImnude.exe	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2848	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
Token: SeDebugPrivilege	2848	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2848	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	29
PID 1680 wrote to memory of 2848	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	29
PID 1680 wrote to memory of 2848	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	29
PID 1680 wrote to memory of 2520	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	30
PID 1680 wrote to memory of 2520	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	30
PID 1680 wrote to memory of 2520	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	30
PID 1680 wrote to memory of 2760	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	31
PID 1680 wrote to memory of 2760	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	31
PID 1680 wrote to memory of 2760	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	31
PID 1680 wrote to memory of 2692	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	32
PID 1680 wrote to memory of 2692	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	32
PID 1680 wrote to memory of 2692	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	32
PID 1680 wrote to memory of 2880	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	33
PID 1680 wrote to memory of 2880	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	33
PID 1680 wrote to memory of 2880	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	33
PID 1680 wrote to memory of 2456	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	34
PID 1680 wrote to memory of 2456	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	34
PID 1680 wrote to memory of 2456	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	34
PID 1680 wrote to memory of 2408	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	35
PID 1680 wrote to memory of 2408	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	35
PID 1680 wrote to memory of 2408	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	35
PID 1680 wrote to memory of 2488	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	36
PID 1680 wrote to memory of 2488	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	36
PID 1680 wrote to memory of 2488	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	36
PID 1680 wrote to memory of 2884	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	37
PID 1680 wrote to memory of 2884	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	37
PID 1680 wrote to memory of 2884	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	37
PID 1680 wrote to memory of 2856	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	38
PID 1680 wrote to memory of 2856	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	38
PID 1680 wrote to memory of 2856	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	38
PID 1680 wrote to memory of 328	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	39
PID 1680 wrote to memory of 328	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	39
PID 1680 wrote to memory of 328	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	39
PID 1680 wrote to memory of 1212	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	40
PID 1680 wrote to memory of 1212	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	40
PID 1680 wrote to memory of 1212	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	40
PID 1680 wrote to memory of 2396	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	41
PID 1680 wrote to memory of 2396	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	41
PID 1680 wrote to memory of 2396	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	41
PID 1680 wrote to memory of 2644	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	42
PID 1680 wrote to memory of 2644	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	42
PID 1680 wrote to memory of 2644	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	42
PID 1680 wrote to memory of 2708	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	43
PID 1680 wrote to memory of 2708	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	43
PID 1680 wrote to memory of 2708	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	43
PID 1680 wrote to memory of 1780	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	44
PID 1680 wrote to memory of 1780	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	44
PID 1680 wrote to memory of 1780	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	44
PID 1680 wrote to memory of 1596	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	45
PID 1680 wrote to memory of 1596	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	45
PID 1680 wrote to memory of 1596	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	45
PID 1680 wrote to memory of 2144	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	46
PID 1680 wrote to memory of 2144	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	46
PID 1680 wrote to memory of 2144	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	46
PID 1680 wrote to memory of 2172	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	47
PID 1680 wrote to memory of 2172	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	47
PID 1680 wrote to memory of 2172	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	47
PID 1680 wrote to memory of 2136	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	48
PID 1680 wrote to memory of 2136	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	48
PID 1680 wrote to memory of 2136	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	48
PID 1680 wrote to memory of 1464	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	49
PID 1680 wrote to memory of 1464	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	49
PID 1680 wrote to memory of 1464	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	49
PID 1680 wrote to memory of 1632	1680	11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11fe16c9029051d46f33568fbb908796_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\System\KYdPPMX.exe
  C:\Windows\System\KYdPPMX.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\NTOqsXs.exe
  C:\Windows\System\NTOqsXs.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\AptbJte.exe
  C:\Windows\System\AptbJte.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\LZCIwzD.exe
  C:\Windows\System\LZCIwzD.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\giAcBBz.exe
  C:\Windows\System\giAcBBz.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\cMZnYWt.exe
  C:\Windows\System\cMZnYWt.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\DUfmsbR.exe
  C:\Windows\System\DUfmsbR.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\rWTvFnV.exe
  C:\Windows\System\rWTvFnV.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\SKchegs.exe
  C:\Windows\System\SKchegs.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\FohQaIo.exe
  C:\Windows\System\FohQaIo.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\zjjoFqE.exe
  C:\Windows\System\zjjoFqE.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\JfWlAUz.exe
  C:\Windows\System\JfWlAUz.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\wwrQYVv.exe
  C:\Windows\System\wwrQYVv.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\ucZMjiE.exe
  C:\Windows\System\ucZMjiE.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\xrOjbhI.exe
  C:\Windows\System\xrOjbhI.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\ZXqfpXB.exe
  C:\Windows\System\ZXqfpXB.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\bGQcIau.exe
  C:\Windows\System\bGQcIau.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\shVMxMP.exe
  C:\Windows\System\shVMxMP.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\xogiRDd.exe
  C:\Windows\System\xogiRDd.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\pxaEQzy.exe
  C:\Windows\System\pxaEQzy.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\eOduqYf.exe
  C:\Windows\System\eOduqYf.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\yTVhvil.exe
  C:\Windows\System\yTVhvil.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\PCVHpQH.exe
  C:\Windows\System\PCVHpQH.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\EkqPaGC.exe
  C:\Windows\System\EkqPaGC.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\vhTboYn.exe
  C:\Windows\System\vhTboYn.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\eZQNDbw.exe
  C:\Windows\System\eZQNDbw.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\DLkCoad.exe
  C:\Windows\System\DLkCoad.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\SDWjzkE.exe
  C:\Windows\System\SDWjzkE.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\BbKcIFZ.exe
  C:\Windows\System\BbKcIFZ.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\SgEdals.exe
  C:\Windows\System\SgEdals.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\aLuUCmZ.exe
  C:\Windows\System\aLuUCmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\sVemCEj.exe
  C:\Windows\System\sVemCEj.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\BGglnUt.exe
  C:\Windows\System\BGglnUt.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\eslptKb.exe
  C:\Windows\System\eslptKb.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\saOoJal.exe
  C:\Windows\System\saOoJal.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\QlPSqtd.exe
  C:\Windows\System\QlPSqtd.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\IMZCGTI.exe
  C:\Windows\System\IMZCGTI.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\xCidURB.exe
  C:\Windows\System\xCidURB.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\ElGCsRP.exe
  C:\Windows\System\ElGCsRP.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\ClSaLFJ.exe
  C:\Windows\System\ClSaLFJ.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\AWxMkLo.exe
  C:\Windows\System\AWxMkLo.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\NJZjGZb.exe
  C:\Windows\System\NJZjGZb.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\TpAIPzi.exe
  C:\Windows\System\TpAIPzi.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\VjXAOcR.exe
  C:\Windows\System\VjXAOcR.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\LUXPAIV.exe
  C:\Windows\System\LUXPAIV.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\CSyhWux.exe
  C:\Windows\System\CSyhWux.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\fsryvoq.exe
  C:\Windows\System\fsryvoq.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\MAFniGN.exe
  C:\Windows\System\MAFniGN.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\VwDXRMp.exe
  C:\Windows\System\VwDXRMp.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\gldsPDd.exe
  C:\Windows\System\gldsPDd.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\EBLRnJM.exe
  C:\Windows\System\EBLRnJM.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\VqwABVy.exe
  C:\Windows\System\VqwABVy.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\sYLXHcq.exe
  C:\Windows\System\sYLXHcq.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\DCWHNzX.exe
  C:\Windows\System\DCWHNzX.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\TxganaH.exe
  C:\Windows\System\TxganaH.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\IMVAydQ.exe
  C:\Windows\System\IMVAydQ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\SKyzLLm.exe
  C:\Windows\System\SKyzLLm.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\jNwiDdF.exe
  C:\Windows\System\jNwiDdF.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\LoMsZAr.exe
  C:\Windows\System\LoMsZAr.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\rYxjRLN.exe
  C:\Windows\System\rYxjRLN.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\exPHKBR.exe
  C:\Windows\System\exPHKBR.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\hZpVzdq.exe
  C:\Windows\System\hZpVzdq.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\icXgosg.exe
  C:\Windows\System\icXgosg.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\QiSBbGg.exe
  C:\Windows\System\QiSBbGg.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\XhRtfKL.exe
  C:\Windows\System\XhRtfKL.exe
  2⤵
  PID:2380
- C:\Windows\System\RfHDwTZ.exe
  C:\Windows\System\RfHDwTZ.exe
  2⤵
  PID:2152
- C:\Windows\System\RxCXRQN.exe
  C:\Windows\System\RxCXRQN.exe
  2⤵
  PID:1628
- C:\Windows\System\eytPoqJ.exe
  C:\Windows\System\eytPoqJ.exe
  2⤵
  PID:3004
- C:\Windows\System\YHwzgGF.exe
  C:\Windows\System\YHwzgGF.exe
  2⤵
  PID:2780
- C:\Windows\System\xOkZlho.exe
  C:\Windows\System\xOkZlho.exe
  2⤵
  PID:716
- C:\Windows\System\hVcTTII.exe
  C:\Windows\System\hVcTTII.exe
  2⤵
  PID:796
- C:\Windows\System\KHJmTYw.exe
  C:\Windows\System\KHJmTYw.exe
  2⤵
  PID:2312
- C:\Windows\System\ypXXwJv.exe
  C:\Windows\System\ypXXwJv.exe
  2⤵
  PID:2116
- C:\Windows\System\oNyuHyq.exe
  C:\Windows\System\oNyuHyq.exe
  2⤵
  PID:2604
- C:\Windows\System\iFDrHNk.exe
  C:\Windows\System\iFDrHNk.exe
  2⤵
  PID:1472
- C:\Windows\System\jQQRPEl.exe
  C:\Windows\System\jQQRPEl.exe
  2⤵
  PID:2328
- C:\Windows\System\uNNBHxF.exe
  C:\Windows\System\uNNBHxF.exe
  2⤵
  PID:1904
- C:\Windows\System\unheWYa.exe
  C:\Windows\System\unheWYa.exe
  2⤵
  PID:292
- C:\Windows\System\lMnOPkp.exe
  C:\Windows\System\lMnOPkp.exe
  2⤵
  PID:924
- C:\Windows\System\IfVrGpX.exe
  C:\Windows\System\IfVrGpX.exe
  2⤵
  PID:2292
- C:\Windows\System\zWaNGiK.exe
  C:\Windows\System\zWaNGiK.exe
  2⤵
  PID:2300
- C:\Windows\System\qpzFpvO.exe
  C:\Windows\System\qpzFpvO.exe
  2⤵
  PID:2200
- C:\Windows\System\ORjQjUp.exe
  C:\Windows\System\ORjQjUp.exe
  2⤵
  PID:1224
- C:\Windows\System\RyJQkyn.exe
  C:\Windows\System\RyJQkyn.exe
  2⤵
  PID:900
- C:\Windows\System\ggkIUXT.exe
  C:\Windows\System\ggkIUXT.exe
  2⤵
  PID:2800
- C:\Windows\System\HHlqWvB.exe
  C:\Windows\System\HHlqWvB.exe
  2⤵
  PID:2236
- C:\Windows\System\daMQXcP.exe
  C:\Windows\System\daMQXcP.exe
  2⤵
  PID:2344
- C:\Windows\System\xfgXsBf.exe
  C:\Windows\System\xfgXsBf.exe
  2⤵
  PID:2464
- C:\Windows\System\vPQVGyD.exe
  C:\Windows\System\vPQVGyD.exe
  2⤵
  PID:1520
- C:\Windows\System\IerkeNi.exe
  C:\Windows\System\IerkeNi.exe
  2⤵
  PID:676
- C:\Windows\System\JANyfxw.exe
  C:\Windows\System\JANyfxw.exe
  2⤵
  PID:2124
- C:\Windows\System\EHSbdUv.exe
  C:\Windows\System\EHSbdUv.exe
  2⤵
  PID:696
- C:\Windows\System\JbUQoAt.exe
  C:\Windows\System\JbUQoAt.exe
  2⤵
  PID:916
- C:\Windows\System\qtObveb.exe
  C:\Windows\System\qtObveb.exe
  2⤵
  PID:2964
- C:\Windows\System\sCNCozC.exe
  C:\Windows\System\sCNCozC.exe
  2⤵
  PID:1908
- C:\Windows\System\UnodOQm.exe
  C:\Windows\System\UnodOQm.exe
  2⤵
  PID:384
- C:\Windows\System\mtybhlv.exe
  C:\Windows\System\mtybhlv.exe
  2⤵
  PID:380
- C:\Windows\System\kUEwCeT.exe
  C:\Windows\System\kUEwCeT.exe
  2⤵
  PID:2952
- C:\Windows\System\mOVGEZP.exe
  C:\Windows\System\mOVGEZP.exe
  2⤵
  PID:1028
- C:\Windows\System\DsQxoEN.exe
  C:\Windows\System\DsQxoEN.exe
  2⤵
  PID:604
- C:\Windows\System\UiZNGSr.exe
  C:\Windows\System\UiZNGSr.exe
  2⤵
  PID:448
- C:\Windows\System\DuaoXyn.exe
  C:\Windows\System\DuaoXyn.exe
  2⤵
  PID:1556
- C:\Windows\System\gqKJrjm.exe
  C:\Windows\System\gqKJrjm.exe
  2⤵
  PID:644
- C:\Windows\System\OEiXcya.exe
  C:\Windows\System\OEiXcya.exe
  2⤵
  PID:1660
- C:\Windows\System\nODNHqv.exe
  C:\Windows\System\nODNHqv.exe
  2⤵
  PID:2428
- C:\Windows\System\wbLhwBS.exe
  C:\Windows\System\wbLhwBS.exe
  2⤵
  PID:1748
- C:\Windows\System\VEAbVIf.exe
  C:\Windows\System\VEAbVIf.exe
  2⤵
  PID:2168
- C:\Windows\System\usUnVBb.exe
  C:\Windows\System\usUnVBb.exe
  2⤵
  PID:700
- C:\Windows\System\qcPJGsa.exe
  C:\Windows\System\qcPJGsa.exe
  2⤵
  PID:1956
- C:\Windows\System\kBtywZr.exe
  C:\Windows\System\kBtywZr.exe
  2⤵
  PID:1756
- C:\Windows\System\vUFyBSp.exe
  C:\Windows\System\vUFyBSp.exe
  2⤵
  PID:2832
- C:\Windows\System\utVCDXn.exe
  C:\Windows\System\utVCDXn.exe
  2⤵
  PID:2448
- C:\Windows\System\daekhUb.exe
  C:\Windows\System\daekhUb.exe
  2⤵
  PID:2852
- C:\Windows\System\fwhLFqr.exe
  C:\Windows\System\fwhLFqr.exe
  2⤵
  PID:2716
- C:\Windows\System\etgRkCK.exe
  C:\Windows\System\etgRkCK.exe
  2⤵
  PID:1652
- C:\Windows\System\OOhcPLx.exe
  C:\Windows\System\OOhcPLx.exe
  2⤵
  PID:2696
- C:\Windows\System\VviZWRX.exe
  C:\Windows\System\VviZWRX.exe
  2⤵
  PID:2132
- C:\Windows\System\AcLiSTk.exe
  C:\Windows\System\AcLiSTk.exe
  2⤵
  PID:1276
- C:\Windows\System\nCqNgYH.exe
  C:\Windows\System\nCqNgYH.exe
  2⤵
  PID:1444
- C:\Windows\System\rTaZmEk.exe
  C:\Windows\System\rTaZmEk.exe
  2⤵
  PID:1496
- C:\Windows\System\tkWwota.exe
  C:\Windows\System\tkWwota.exe
  2⤵
  PID:2844
- C:\Windows\System\onvJSGT.exe
  C:\Windows\System\onvJSGT.exe
  2⤵
  PID:2252
- C:\Windows\System\cHxPACn.exe
  C:\Windows\System\cHxPACn.exe
  2⤵
  PID:2544
- C:\Windows\System\sYIbisw.exe
  C:\Windows\System\sYIbisw.exe
  2⤵
  PID:320
- C:\Windows\System\nAHNAgR.exe
  C:\Windows\System\nAHNAgR.exe
  2⤵
  PID:1268
- C:\Windows\System\MjLijIq.exe
  C:\Windows\System\MjLijIq.exe
  2⤵
  PID:2636
- C:\Windows\System\xRrXwcz.exe
  C:\Windows\System\xRrXwcz.exe
  2⤵
  PID:300
- C:\Windows\System\gxofsAw.exe
  C:\Windows\System\gxofsAw.exe
  2⤵
  PID:1068
- C:\Windows\System\QTvYjuS.exe
  C:\Windows\System\QTvYjuS.exe
  2⤵
  PID:2680
- C:\Windows\System\ATNQEvw.exe
  C:\Windows\System\ATNQEvw.exe
  2⤵
  PID:2972
- C:\Windows\System\hQbHWEv.exe
  C:\Windows\System\hQbHWEv.exe
  2⤵
  PID:1448
- C:\Windows\System\uMHKczQ.exe
  C:\Windows\System\uMHKczQ.exe
  2⤵
  PID:1200
- C:\Windows\System\UdQOJbO.exe
  C:\Windows\System\UdQOJbO.exe
  2⤵
  PID:1536
- C:\Windows\System\XEoxtKQ.exe
  C:\Windows\System\XEoxtKQ.exe
  2⤵
  PID:1676
- C:\Windows\System\UjHRqjP.exe
  C:\Windows\System\UjHRqjP.exe
  2⤵
  PID:1684
- C:\Windows\System\RGAhiop.exe
  C:\Windows\System\RGAhiop.exe
  2⤵
  PID:2324
- C:\Windows\System\HJEKCKa.exe
  C:\Windows\System\HJEKCKa.exe
  2⤵
  PID:1012
- C:\Windows\System\eEPTZoy.exe
  C:\Windows\System\eEPTZoy.exe
  2⤵
  PID:1332
- C:\Windows\System\AFDVtsi.exe
  C:\Windows\System\AFDVtsi.exe
  2⤵
  PID:1688
- C:\Windows\System\eFQrBTz.exe
  C:\Windows\System\eFQrBTz.exe
  2⤵
  PID:2440
- C:\Windows\System\fUgVwNx.exe
  C:\Windows\System\fUgVwNx.exe
  2⤵
  PID:272
- C:\Windows\System\OmDFwch.exe
  C:\Windows\System\OmDFwch.exe
  2⤵
  PID:2616
- C:\Windows\System\hyeyGFa.exe
  C:\Windows\System\hyeyGFa.exe
  2⤵
  PID:2564
- C:\Windows\System\WSsyxYi.exe
  C:\Windows\System\WSsyxYi.exe
  2⤵
  PID:2340
- C:\Windows\System\QGSYzNp.exe
  C:\Windows\System\QGSYzNp.exe
  2⤵
  PID:2416
- C:\Windows\System\DnMWuak.exe
  C:\Windows\System\DnMWuak.exe
  2⤵
  PID:2308
- C:\Windows\System\FUmKegX.exe
  C:\Windows\System\FUmKegX.exe
  2⤵
  PID:1624
- C:\Windows\System\zMTtUAY.exe
  C:\Windows\System\zMTtUAY.exe
  2⤵
  PID:2688
- C:\Windows\System\YZHloDN.exe
  C:\Windows\System\YZHloDN.exe
  2⤵
  PID:2932
- C:\Windows\System\BQfxkrt.exe
  C:\Windows\System\BQfxkrt.exe
  2⤵
  PID:2296
- C:\Windows\System\wXqaAPv.exe
  C:\Windows\System\wXqaAPv.exe
  2⤵
  PID:2204
- C:\Windows\System\NhalAKO.exe
  C:\Windows\System\NhalAKO.exe
  2⤵
  PID:2648
- C:\Windows\System\wSQheWj.exe
  C:\Windows\System\wSQheWj.exe
  2⤵
  PID:1584
- C:\Windows\System\VZZnNYt.exe
  C:\Windows\System\VZZnNYt.exe
  2⤵
  PID:3152
- C:\Windows\System\SselqNJ.exe
  C:\Windows\System\SselqNJ.exe
  2⤵
  PID:3168
- C:\Windows\System\zLcGyzS.exe
  C:\Windows\System\zLcGyzS.exe
  2⤵
  PID:3184
- C:\Windows\System\MNfwVPQ.exe
  C:\Windows\System\MNfwVPQ.exe
  2⤵
  PID:3200
- C:\Windows\System\rQvnUqu.exe
  C:\Windows\System\rQvnUqu.exe
  2⤵
  PID:3216
- C:\Windows\System\IaZGVLX.exe
  C:\Windows\System\IaZGVLX.exe
  2⤵
  PID:3232
- C:\Windows\System\nHfXAJr.exe
  C:\Windows\System\nHfXAJr.exe
  2⤵
  PID:3248
- C:\Windows\System\EmlzSVs.exe
  C:\Windows\System\EmlzSVs.exe
  2⤵
  PID:3264
- C:\Windows\System\FnIPBqZ.exe
  C:\Windows\System\FnIPBqZ.exe
  2⤵
  PID:3280
- C:\Windows\System\UgMXnJY.exe
  C:\Windows\System\UgMXnJY.exe
  2⤵
  PID:3300
- C:\Windows\System\vkfuqAO.exe
  C:\Windows\System\vkfuqAO.exe
  2⤵
  PID:3316
- C:\Windows\System\YOxcOZV.exe
  C:\Windows\System\YOxcOZV.exe
  2⤵
  PID:3332
- C:\Windows\System\yrTIsjN.exe
  C:\Windows\System\yrTIsjN.exe
  2⤵
  PID:3348
- C:\Windows\System\ZoIiNLh.exe
  C:\Windows\System\ZoIiNLh.exe
  2⤵
  PID:3412
- C:\Windows\System\unqcxfK.exe
  C:\Windows\System\unqcxfK.exe
  2⤵
  PID:3428
- C:\Windows\System\aOrTQEa.exe
  C:\Windows\System\aOrTQEa.exe
  2⤵
  PID:3444
- C:\Windows\System\dkYOfuX.exe
  C:\Windows\System\dkYOfuX.exe
  2⤵
  PID:3460
- C:\Windows\System\HCpoQSK.exe
  C:\Windows\System\HCpoQSK.exe
  2⤵
  PID:3476
- C:\Windows\System\bubUiyR.exe
  C:\Windows\System\bubUiyR.exe
  2⤵
  PID:3492
- C:\Windows\System\RmLTSsd.exe
  C:\Windows\System\RmLTSsd.exe
  2⤵
  PID:3508
- C:\Windows\System\YJWIBSi.exe
  C:\Windows\System\YJWIBSi.exe
  2⤵
  PID:3524
- C:\Windows\System\HsCvWHU.exe
  C:\Windows\System\HsCvWHU.exe
  2⤵
  PID:3540
- C:\Windows\System\chURSAT.exe
  C:\Windows\System\chURSAT.exe
  2⤵
  PID:3556
- C:\Windows\System\PpDPMuU.exe
  C:\Windows\System\PpDPMuU.exe
  2⤵
  PID:3576
- C:\Windows\System\OBECUmw.exe
  C:\Windows\System\OBECUmw.exe
  2⤵
  PID:3656
- C:\Windows\System\brFAtjf.exe
  C:\Windows\System\brFAtjf.exe
  2⤵
  PID:3676
- C:\Windows\System\QKnmQhI.exe
  C:\Windows\System\QKnmQhI.exe
  2⤵
  PID:3692
- C:\Windows\System\ZNVKevS.exe
  C:\Windows\System\ZNVKevS.exe
  2⤵
  PID:3708
- C:\Windows\System\OvWqlea.exe
  C:\Windows\System\OvWqlea.exe
  2⤵
  PID:3724
- C:\Windows\System\JbmzFYb.exe
  C:\Windows\System\JbmzFYb.exe
  2⤵
  PID:3740
- C:\Windows\System\UweJsJe.exe
  C:\Windows\System\UweJsJe.exe
  2⤵
  PID:3756
- C:\Windows\System\RQBPkvD.exe
  C:\Windows\System\RQBPkvD.exe
  2⤵
  PID:3780
- C:\Windows\System\hvlPfXY.exe
  C:\Windows\System\hvlPfXY.exe
  2⤵
  PID:3796
- C:\Windows\System\tsfCgge.exe
  C:\Windows\System\tsfCgge.exe
  2⤵
  PID:3812
- C:\Windows\System\FdCkfkU.exe
  C:\Windows\System\FdCkfkU.exe
  2⤵
  PID:3828
- C:\Windows\System\AJDLYXT.exe
  C:\Windows\System\AJDLYXT.exe
  2⤵
  PID:3844
- C:\Windows\System\rVLNgRR.exe
  C:\Windows\System\rVLNgRR.exe
  2⤵
  PID:3860
- C:\Windows\System\RrxgGAq.exe
  C:\Windows\System\RrxgGAq.exe
  2⤵
  PID:3876
- C:\Windows\System\aajZKva.exe
  C:\Windows\System\aajZKva.exe
  2⤵
  PID:3936
- C:\Windows\System\XagQptO.exe
  C:\Windows\System\XagQptO.exe
  2⤵
  PID:3956
- C:\Windows\System\bNWJGkd.exe
  C:\Windows\System\bNWJGkd.exe
  2⤵
  PID:3972
- C:\Windows\System\AhUvUEm.exe
  C:\Windows\System\AhUvUEm.exe
  2⤵
  PID:3988
- C:\Windows\System\DSHcQDT.exe
  C:\Windows\System\DSHcQDT.exe
  2⤵
  PID:4004
- C:\Windows\System\XLkkKVE.exe
  C:\Windows\System\XLkkKVE.exe
  2⤵
  PID:4020
- C:\Windows\System\bDDGYiI.exe
  C:\Windows\System\bDDGYiI.exe
  2⤵
  PID:4036
- C:\Windows\System\EmMITVy.exe
  C:\Windows\System\EmMITVy.exe
  2⤵
  PID:4052
- C:\Windows\System\WXiEaqk.exe
  C:\Windows\System\WXiEaqk.exe
  2⤵
  PID:4068
- C:\Windows\System\VlnvwNS.exe
  C:\Windows\System\VlnvwNS.exe
  2⤵
  PID:4084
- C:\Windows\System\jWhxlTY.exe
  C:\Windows\System\jWhxlTY.exe
  2⤵
  PID:2184
- C:\Windows\System\OzkyUcy.exe
  C:\Windows\System\OzkyUcy.exe
  2⤵
  PID:1976
- C:\Windows\System\OLiKTBl.exe
  C:\Windows\System\OLiKTBl.exe
  2⤵
  PID:2816
- C:\Windows\System\XqOQOWb.exe
  C:\Windows\System\XqOQOWb.exe
  2⤵
  PID:1644
- C:\Windows\System\YabOFTD.exe
  C:\Windows\System\YabOFTD.exe
  2⤵
  PID:1420
- C:\Windows\System\WNQIsxS.exe
  C:\Windows\System\WNQIsxS.exe
  2⤵
  PID:488
- C:\Windows\System\IHYoIjQ.exe
  C:\Windows\System\IHYoIjQ.exe
  2⤵
  PID:1080
- C:\Windows\System\mrIonjp.exe
  C:\Windows\System\mrIonjp.exe
  2⤵
  PID:1560
- C:\Windows\System\ITyPIGM.exe
  C:\Windows\System\ITyPIGM.exe
  2⤵
  PID:3104
- C:\Windows\System\oeZYCOv.exe
  C:\Windows\System\oeZYCOv.exe
  2⤵
  PID:3124
- C:\Windows\System\tbOArBF.exe
  C:\Windows\System\tbOArBF.exe
  2⤵
  PID:2192
- C:\Windows\System\YEKzxzt.exe
  C:\Windows\System\YEKzxzt.exe
  2⤵
  PID:3148
- C:\Windows\System\HhMyRWN.exe
  C:\Windows\System\HhMyRWN.exe
  2⤵
  PID:3240
- C:\Windows\System\hFlqEcb.exe
  C:\Windows\System\hFlqEcb.exe
  2⤵
  PID:3196
- C:\Windows\System\kdpcYKI.exe
  C:\Windows\System\kdpcYKI.exe
  2⤵
  PID:3276
- C:\Windows\System\LuuyeBs.exe
  C:\Windows\System\LuuyeBs.exe
  2⤵
  PID:3296
- C:\Windows\System\dCbFWPD.exe
  C:\Windows\System\dCbFWPD.exe
  2⤵
  PID:3308
- C:\Windows\System\myLzrVx.exe
  C:\Windows\System\myLzrVx.exe
  2⤵
  PID:3472
- C:\Windows\System\zMNBuNd.exe
  C:\Windows\System\zMNBuNd.exe
  2⤵
  PID:3536
- C:\Windows\System\SupzjXJ.exe
  C:\Windows\System\SupzjXJ.exe
  2⤵
  PID:1004
- C:\Windows\System\xPaUvVW.exe
  C:\Windows\System\xPaUvVW.exe
  2⤵
  PID:3584
- C:\Windows\System\hKQoBOQ.exe
  C:\Windows\System\hKQoBOQ.exe
  2⤵
  PID:3600
- C:\Windows\System\BiVUCvS.exe
  C:\Windows\System\BiVUCvS.exe
  2⤵
  PID:3624
- C:\Windows\System\kbDAive.exe
  C:\Windows\System\kbDAive.exe
  2⤵
  PID:3652
- C:\Windows\System\VQIaibt.exe
  C:\Windows\System\VQIaibt.exe
  2⤵
  PID:3668
- C:\Windows\System\UMvNwam.exe
  C:\Windows\System\UMvNwam.exe
  2⤵
  PID:1920
- C:\Windows\System\ZhkgSYI.exe
  C:\Windows\System\ZhkgSYI.exe
  2⤵
  PID:3788
- C:\Windows\System\qdROZWA.exe
  C:\Windows\System\qdROZWA.exe
  2⤵
  PID:3852
- C:\Windows\System\ygzOdGG.exe
  C:\Windows\System\ygzOdGG.exe
  2⤵
  PID:3824
- C:\Windows\System\cnQkiio.exe
  C:\Windows\System\cnQkiio.exe
  2⤵
  PID:3764
- C:\Windows\System\NwjAMFk.exe
  C:\Windows\System\NwjAMFk.exe
  2⤵
  PID:3856
- C:\Windows\System\nvljFwx.exe
  C:\Windows\System\nvljFwx.exe
  2⤵
  PID:3808
- C:\Windows\System\ezNfPoX.exe
  C:\Windows\System\ezNfPoX.exe
  2⤵
  PID:3892
- C:\Windows\System\UyJiwwj.exe
  C:\Windows\System\UyJiwwj.exe
  2⤵
  PID:3916
- C:\Windows\System\ZwUKDdL.exe
  C:\Windows\System\ZwUKDdL.exe
  2⤵
  PID:3924
- C:\Windows\System\OgocSxu.exe
  C:\Windows\System\OgocSxu.exe
  2⤵
  PID:3996
- C:\Windows\System\MhdraTk.exe
  C:\Windows\System\MhdraTk.exe
  2⤵
  PID:3944
- C:\Windows\System\BQAOliy.exe
  C:\Windows\System\BQAOliy.exe
  2⤵
  PID:3968
- C:\Windows\System\doQwuaC.exe
  C:\Windows\System\doQwuaC.exe
  2⤵
  PID:1888
- C:\Windows\System\RUTkBbO.exe
  C:\Windows\System\RUTkBbO.exe
  2⤵
  PID:2984
- C:\Windows\System\khocAmz.exe
  C:\Windows\System\khocAmz.exe
  2⤵
  PID:4060
- C:\Windows\System\ogGAEFH.exe
  C:\Windows\System\ogGAEFH.exe
  2⤵
  PID:3356
- C:\Windows\System\qrwKZhD.exe
  C:\Windows\System\qrwKZhD.exe
  2⤵
  PID:2924
- C:\Windows\System\FuULwuf.exe
  C:\Windows\System\FuULwuf.exe
  2⤵
  PID:3256
- C:\Windows\System\BGgnMUA.exe
  C:\Windows\System\BGgnMUA.exe
  2⤵
  PID:3952
- C:\Windows\System\oFZdVXD.exe
  C:\Windows\System\oFZdVXD.exe
  2⤵
  PID:3292
- C:\Windows\System\lASxLWH.exe
  C:\Windows\System\lASxLWH.exe
  2⤵
  PID:4044
- C:\Windows\System\KguDUvj.exe
  C:\Windows\System\KguDUvj.exe
  2⤵
  PID:2176
- C:\Windows\System\MOoFEQD.exe
  C:\Windows\System\MOoFEQD.exe
  2⤵
  PID:2452
- C:\Windows\System\wHsIWSe.exe
  C:\Windows\System\wHsIWSe.exe
  2⤵
  PID:2824
- C:\Windows\System\oCGeyjP.exe
  C:\Windows\System\oCGeyjP.exe
  2⤵
  PID:3368
- C:\Windows\System\fNoEMce.exe
  C:\Windows\System\fNoEMce.exe
  2⤵
  PID:3384
- C:\Windows\System\EApJnJd.exe
  C:\Windows\System\EApJnJd.exe
  2⤵
  PID:3392
- C:\Windows\System\uuhKcZh.exe
  C:\Windows\System\uuhKcZh.exe
  2⤵
  PID:3452
- C:\Windows\System\YrSuNbW.exe
  C:\Windows\System\YrSuNbW.exe
  2⤵
  PID:3408
- C:\Windows\System\fRjDzzV.exe
  C:\Windows\System\fRjDzzV.exe
  2⤵
  PID:3488
- C:\Windows\System\AJAVhZc.exe
  C:\Windows\System\AJAVhZc.exe
  2⤵
  PID:3548
- C:\Windows\System\uBZyrFw.exe
  C:\Windows\System\uBZyrFw.exe
  2⤵
  PID:3688
- C:\Windows\System\BBxneKb.exe
  C:\Windows\System\BBxneKb.exe
  2⤵
  PID:3552
- C:\Windows\System\hLQetkV.exe
  C:\Windows\System\hLQetkV.exe
  2⤵
  PID:4104
- C:\Windows\System\YbYBjAA.exe
  C:\Windows\System\YbYBjAA.exe
  2⤵
  PID:4120
- C:\Windows\System\xBXeoVR.exe
  C:\Windows\System\xBXeoVR.exe
  2⤵
  PID:4136
- C:\Windows\System\SAteTol.exe
  C:\Windows\System\SAteTol.exe
  2⤵
  PID:4156
- C:\Windows\System\AzEyMPR.exe
  C:\Windows\System\AzEyMPR.exe
  2⤵
  PID:4172
- C:\Windows\System\bPOWxjs.exe
  C:\Windows\System\bPOWxjs.exe
  2⤵
  PID:4188
- C:\Windows\System\KZUgRpE.exe
  C:\Windows\System\KZUgRpE.exe
  2⤵
  PID:4204
- C:\Windows\System\Ldijnlo.exe
  C:\Windows\System\Ldijnlo.exe
  2⤵
  PID:4220
- C:\Windows\System\eDgLVnL.exe
  C:\Windows\System\eDgLVnL.exe
  2⤵
  PID:4240
- C:\Windows\System\PqlkVRK.exe
  C:\Windows\System\PqlkVRK.exe
  2⤵
  PID:4256
- C:\Windows\System\xjrEZDr.exe
  C:\Windows\System\xjrEZDr.exe
  2⤵
  PID:4272
- C:\Windows\System\ozUzxnH.exe
  C:\Windows\System\ozUzxnH.exe
  2⤵
  PID:4288
- C:\Windows\System\JYQRfDQ.exe
  C:\Windows\System\JYQRfDQ.exe
  2⤵
  PID:4304
- C:\Windows\System\jDkbuzx.exe
  C:\Windows\System\jDkbuzx.exe
  2⤵
  PID:4320
- C:\Windows\System\GiYJIQV.exe
  C:\Windows\System\GiYJIQV.exe
  2⤵
  PID:4340
- C:\Windows\System\QCcIJxO.exe
  C:\Windows\System\QCcIJxO.exe
  2⤵
  PID:4356
- C:\Windows\System\rulnzYI.exe
  C:\Windows\System\rulnzYI.exe
  2⤵
  PID:4372
- C:\Windows\System\jSOFVXM.exe
  C:\Windows\System\jSOFVXM.exe
  2⤵
  PID:4388
- C:\Windows\System\mfTsEIf.exe
  C:\Windows\System\mfTsEIf.exe
  2⤵
  PID:4404
- C:\Windows\System\CUXuBTg.exe
  C:\Windows\System\CUXuBTg.exe
  2⤵
  PID:4420
- C:\Windows\System\OKZtJac.exe
  C:\Windows\System\OKZtJac.exe
  2⤵
  PID:4436
- C:\Windows\System\cbyLcXr.exe
  C:\Windows\System\cbyLcXr.exe
  2⤵
  PID:4452
- C:\Windows\System\tvBxVqD.exe
  C:\Windows\System\tvBxVqD.exe
  2⤵
  PID:4472
- C:\Windows\System\AWIXtxZ.exe
  C:\Windows\System\AWIXtxZ.exe
  2⤵
  PID:4488
- C:\Windows\System\XhkGHAT.exe
  C:\Windows\System\XhkGHAT.exe
  2⤵
  PID:4504
- C:\Windows\System\sWjHyqO.exe
  C:\Windows\System\sWjHyqO.exe
  2⤵
  PID:4520
- C:\Windows\System\ajGXcnp.exe
  C:\Windows\System\ajGXcnp.exe
  2⤵
  PID:4536
- C:\Windows\System\DYItuhL.exe
  C:\Windows\System\DYItuhL.exe
  2⤵
  PID:4556
- C:\Windows\System\ssHLxgI.exe
  C:\Windows\System\ssHLxgI.exe
  2⤵
  PID:4572
- C:\Windows\System\wofMrhk.exe
  C:\Windows\System\wofMrhk.exe
  2⤵
  PID:4588
- C:\Windows\System\wjaKqDf.exe
  C:\Windows\System\wjaKqDf.exe
  2⤵
  PID:4604
- C:\Windows\System\cjjAuqh.exe
  C:\Windows\System\cjjAuqh.exe
  2⤵
  PID:4620
- C:\Windows\System\siZYIHy.exe
  C:\Windows\System\siZYIHy.exe
  2⤵
  PID:4636
- C:\Windows\System\HyNuhwk.exe
  C:\Windows\System\HyNuhwk.exe
  2⤵
  PID:4652
- C:\Windows\System\UTusmgQ.exe
  C:\Windows\System\UTusmgQ.exe
  2⤵
  PID:4672
- C:\Windows\System\jbfELTJ.exe
  C:\Windows\System\jbfELTJ.exe
  2⤵
  PID:4688
- C:\Windows\System\wExAtfl.exe
  C:\Windows\System\wExAtfl.exe
  2⤵
  PID:4704
- C:\Windows\System\mFDcUaE.exe
  C:\Windows\System\mFDcUaE.exe
  2⤵
  PID:4720
- C:\Windows\System\kUpnVfO.exe
  C:\Windows\System\kUpnVfO.exe
  2⤵
  PID:4736
- C:\Windows\System\ZPvKDSO.exe
  C:\Windows\System\ZPvKDSO.exe
  2⤵
  PID:4752
- C:\Windows\System\XYsRoHK.exe
  C:\Windows\System\XYsRoHK.exe
  2⤵
  PID:4772
- C:\Windows\System\ypvJNNL.exe
  C:\Windows\System\ypvJNNL.exe
  2⤵
  PID:4788
- C:\Windows\System\siZaYMp.exe
  C:\Windows\System\siZaYMp.exe
  2⤵
  PID:4804
- C:\Windows\System\xZcOHQv.exe
  C:\Windows\System\xZcOHQv.exe
  2⤵
  PID:4820
- C:\Windows\System\FcMPGbY.exe
  C:\Windows\System\FcMPGbY.exe
  2⤵
  PID:4836
- C:\Windows\System\RcYSmDE.exe
  C:\Windows\System\RcYSmDE.exe
  2⤵
  PID:4852
- C:\Windows\System\jMnaIfA.exe
  C:\Windows\System\jMnaIfA.exe
  2⤵
  PID:4868
- C:\Windows\System\yVXTAcm.exe
  C:\Windows\System\yVXTAcm.exe
  2⤵
  PID:4884
- C:\Windows\System\bprQqpj.exe
  C:\Windows\System\bprQqpj.exe
  2⤵
  PID:4900
- C:\Windows\System\WOXSBBa.exe
  C:\Windows\System\WOXSBBa.exe
  2⤵
  PID:4916
- C:\Windows\System\kTaGgUj.exe
  C:\Windows\System\kTaGgUj.exe
  2⤵
  PID:4932
- C:\Windows\System\Jazhzra.exe
  C:\Windows\System\Jazhzra.exe
  2⤵
  PID:4948
- C:\Windows\System\gsxtXpv.exe
  C:\Windows\System\gsxtXpv.exe
  2⤵
  PID:4964
- C:\Windows\System\HUSviiA.exe
  C:\Windows\System\HUSviiA.exe
  2⤵
  PID:4980
- C:\Windows\System\LOBKABV.exe
  C:\Windows\System\LOBKABV.exe
  2⤵
  PID:4996
- C:\Windows\System\cUrHRtH.exe
  C:\Windows\System\cUrHRtH.exe
  2⤵
  PID:5064
- C:\Windows\System\qMoheEk.exe
  C:\Windows\System\qMoheEk.exe
  2⤵
  PID:4184
- C:\Windows\System\CEQGlsh.exe
  C:\Windows\System\CEQGlsh.exe
  2⤵
  PID:4380
- C:\Windows\System\ZmbeQyE.exe
  C:\Windows\System\ZmbeQyE.exe
  2⤵
  PID:4448
- C:\Windows\System\duobVwg.exe
  C:\Windows\System\duobVwg.exe
  2⤵
  PID:4648
- C:\Windows\System\LZEqEjB.exe
  C:\Windows\System\LZEqEjB.exe
  2⤵
  PID:4748
- C:\Windows\System\hIWZYnJ.exe
  C:\Windows\System\hIWZYnJ.exe
  2⤵
  PID:4812
- C:\Windows\System\HvaQfng.exe
  C:\Windows\System\HvaQfng.exe
  2⤵
  PID:4548
- C:\Windows\System\MFCUfUi.exe
  C:\Windows\System\MFCUfUi.exe
  2⤵
  PID:4944
- C:\Windows\System\nGpINPk.exe
  C:\Windows\System\nGpINPk.exe
  2⤵
  PID:3212
- C:\Windows\System\hTDioaY.exe
  C:\Windows\System\hTDioaY.exe
  2⤵
  PID:4080
- C:\Windows\System\bhEosAc.exe
  C:\Windows\System\bhEosAc.exe
  2⤵
  PID:344
- C:\Windows\System\CPjcRrw.exe
  C:\Windows\System\CPjcRrw.exe
  2⤵
  PID:4268
- C:\Windows\System\gMgOLHJ.exe
  C:\Windows\System\gMgOLHJ.exe
  2⤵
  PID:4800
- C:\Windows\System\LakyzPO.exe
  C:\Windows\System\LakyzPO.exe
  2⤵
  PID:3704
- C:\Windows\System\qdZRTLY.exe
  C:\Windows\System\qdZRTLY.exe
  2⤵
  PID:2744
- C:\Windows\System\hsUuDIe.exe
  C:\Windows\System\hsUuDIe.exe
  2⤵
  PID:3532
- C:\Windows\System\xufWJpi.exe
  C:\Windows\System\xufWJpi.exe
  2⤵
  PID:2612
- C:\Windows\System\vDCUMBV.exe
  C:\Windows\System\vDCUMBV.exe
  2⤵
  PID:4164
- C:\Windows\System\ITZFSEZ.exe
  C:\Windows\System\ITZFSEZ.exe
  2⤵
  PID:4232
- C:\Windows\System\AFwxmcZ.exe
  C:\Windows\System\AFwxmcZ.exe
  2⤵
  PID:4364
- C:\Windows\System\dGyNJmQ.exe
  C:\Windows\System\dGyNJmQ.exe
  2⤵
  PID:4432
- C:\Windows\System\GQxvzIZ.exe
  C:\Windows\System\GQxvzIZ.exe
  2⤵
  PID:4528
- C:\Windows\System\LerBqDy.exe
  C:\Windows\System\LerBqDy.exe
  2⤵
  PID:4568
- C:\Windows\System\hKcbuHj.exe
  C:\Windows\System\hKcbuHj.exe
  2⤵
  PID:4728
- C:\Windows\System\dCBomxU.exe
  C:\Windows\System\dCBomxU.exe
  2⤵
  PID:4832
- C:\Windows\System\UxjxYvp.exe
  C:\Windows\System\UxjxYvp.exe
  2⤵
  PID:4896
- C:\Windows\System\Fmqjaro.exe
  C:\Windows\System\Fmqjaro.exe
  2⤵
  PID:3572
- C:\Windows\System\sKanwVd.exe
  C:\Windows\System\sKanwVd.exe
  2⤵
  PID:5020
- C:\Windows\System\bzrCYql.exe
  C:\Windows\System\bzrCYql.exe
  2⤵
  PID:5032
- C:\Windows\System\qGoxjXN.exe
  C:\Windows\System\qGoxjXN.exe
  2⤵
  PID:5040
- C:\Windows\System\rvOHkAC.exe
  C:\Windows\System\rvOHkAC.exe
  2⤵
  PID:1936
- C:\Windows\System\roJmfnE.exe
  C:\Windows\System\roJmfnE.exe
  2⤵
  PID:2508
- C:\Windows\System\DXilDts.exe
  C:\Windows\System\DXilDts.exe
  2⤵
  PID:2008
- C:\Windows\System\BierYmq.exe
  C:\Windows\System\BierYmq.exe
  2⤵
  PID:5092
- C:\Windows\System\xVZIiDW.exe
  C:\Windows\System\xVZIiDW.exe
  2⤵
  PID:1616
- C:\Windows\System\fMLqDwS.exe
  C:\Windows\System\fMLqDwS.exe
  2⤵
  PID:3980
- C:\Windows\System\BaZIjny.exe
  C:\Windows\System\BaZIjny.exe
  2⤵
  PID:3228
- C:\Windows\System\LSLxJfc.exe
  C:\Windows\System\LSLxJfc.exe
  2⤵
  PID:3380
- C:\Windows\System\TxGuthC.exe
  C:\Windows\System\TxGuthC.exe
  2⤵
  PID:2528
- C:\Windows\System\jhpOVfi.exe
  C:\Windows\System\jhpOVfi.exe
  2⤵
  PID:3396
- C:\Windows\System\lyWxAsO.exe
  C:\Windows\System\lyWxAsO.exe
  2⤵
  PID:820
- C:\Windows\System\OZpwYhS.exe
  C:\Windows\System\OZpwYhS.exe
  2⤵
  PID:4148
- C:\Windows\System\gXGihhv.exe
  C:\Windows\System\gXGihhv.exe
  2⤵
  PID:4252
- C:\Windows\System\keIgcyn.exe
  C:\Windows\System\keIgcyn.exe
  2⤵
  PID:4316
- C:\Windows\System\TKsEQhc.exe
  C:\Windows\System\TKsEQhc.exe
  2⤵
  PID:4484
- C:\Windows\System\BuZgiYf.exe
  C:\Windows\System\BuZgiYf.exe
  2⤵
  PID:4552
- C:\Windows\System\jKegHvH.exe
  C:\Windows\System\jKegHvH.exe
  2⤵
  PID:4616
- C:\Windows\System\augoabh.exe
  C:\Windows\System\augoabh.exe
  2⤵
  PID:4712
- C:\Windows\System\LGliGhn.exe
  C:\Windows\System\LGliGhn.exe
  2⤵
  PID:2004
- C:\Windows\System\kjWYsDy.exe
  C:\Windows\System\kjWYsDy.exe
  2⤵
  PID:4908
- C:\Windows\System\hgYRuEJ.exe
  C:\Windows\System\hgYRuEJ.exe
  2⤵
  PID:3588
- C:\Windows\System\wJAQKnm.exe
  C:\Windows\System\wJAQKnm.exe
  2⤵
  PID:3628
- C:\Windows\System\JYTXHNS.exe
  C:\Windows\System\JYTXHNS.exe
  2⤵
  PID:1432
- C:\Windows\System\JtEkBZH.exe
  C:\Windows\System\JtEkBZH.exe
  2⤵
  PID:4332
- C:\Windows\System\SnFtSKb.exe
  C:\Windows\System\SnFtSKb.exe
  2⤵
  PID:4860
- C:\Windows\System\EXnyrpK.exe
  C:\Windows\System\EXnyrpK.exe
  2⤵
  PID:3836
- C:\Windows\System\RqikusA.exe
  C:\Windows\System\RqikusA.exe
  2⤵
  PID:4000
- C:\Windows\System\TvVXugE.exe
  C:\Windows\System\TvVXugE.exe
  2⤵
  PID:3288
- C:\Windows\System\JnYMuEw.exe
  C:\Windows\System\JnYMuEw.exe
  2⤵
  PID:4100
- C:\Windows\System\fPXdEib.exe
  C:\Windows\System\fPXdEib.exe
  2⤵
  PID:3612
- C:\Windows\System\vNKJMjM.exe
  C:\Windows\System\vNKJMjM.exe
  2⤵
  PID:4460
- C:\Windows\System\NIZQexn.exe
  C:\Windows\System\NIZQexn.exe
  2⤵
  PID:4496
- C:\Windows\System\FfPEUhq.exe
  C:\Windows\System\FfPEUhq.exe
  2⤵
  PID:4200
- C:\Windows\System\NTXRLwy.exe
  C:\Windows\System\NTXRLwy.exe
  2⤵
  PID:4396
- C:\Windows\System\vhxWJuA.exe
  C:\Windows\System\vhxWJuA.exe
  2⤵
  PID:4760
- C:\Windows\System\NZeimVR.exe
  C:\Windows\System\NZeimVR.exe
  2⤵
  PID:4064
- C:\Windows\System\ECvAUVP.exe
  C:\Windows\System\ECvAUVP.exe
  2⤵
  PID:2224
- C:\Windows\System\NvPMTNJ.exe
  C:\Windows\System\NvPMTNJ.exe
  2⤵
  PID:4144
- C:\Windows\System\RJXswex.exe
  C:\Windows\System\RJXswex.exe
  2⤵
  PID:4312
- C:\Windows\System\hywBdGF.exe
  C:\Windows\System\hywBdGF.exe
  2⤵
  PID:4684
- C:\Windows\System\kwEvhZV.exe
  C:\Windows\System\kwEvhZV.exe
  2⤵
  PID:4584
- C:\Windows\System\RuISYkh.exe
  C:\Windows\System\RuISYkh.exe
  2⤵
  PID:4940
- C:\Windows\System\XzRZaDp.exe
  C:\Windows\System\XzRZaDp.exe
  2⤵
  PID:3700
- C:\Windows\System\AgcsNps.exe
  C:\Windows\System\AgcsNps.exe
  2⤵
  PID:5008
- C:\Windows\System\ztjtDqs.exe
  C:\Windows\System\ztjtDqs.exe
  2⤵
  PID:4264
- C:\Windows\System\IUyxtqV.exe
  C:\Windows\System\IUyxtqV.exe
  2⤵
  PID:3736
- C:\Windows\System\CrVAeKY.exe
  C:\Windows\System\CrVAeKY.exe
  2⤵
  PID:4132
- C:\Windows\System\pYibOkL.exe
  C:\Windows\System\pYibOkL.exe
  2⤵
  PID:4664
- C:\Windows\System\gnRBtpT.exe
  C:\Windows\System\gnRBtpT.exe
  2⤵
  PID:4428
- C:\Windows\System\sEsiNSt.exe
  C:\Windows\System\sEsiNSt.exe
  2⤵
  PID:4992
- C:\Windows\System\SoWIrgm.exe
  C:\Windows\System\SoWIrgm.exe
  2⤵
  PID:4956
- C:\Windows\System\hBwiOUA.exe
  C:\Windows\System\hBwiOUA.exe
  2⤵
  PID:1788
- C:\Windows\System\BXpQRAK.exe
  C:\Windows\System\BXpQRAK.exe
  2⤵
  PID:4988
- C:\Windows\System\PXoGFVx.exe
  C:\Windows\System\PXoGFVx.exe
  2⤵
  PID:3312
- C:\Windows\System\qZTWbYY.exe
  C:\Windows\System\qZTWbYY.exe
  2⤵
  PID:4248
- C:\Windows\System\zdvOIWL.exe
  C:\Windows\System\zdvOIWL.exe
  2⤵
  PID:4780
- C:\Windows\System\cfvZmKs.exe
  C:\Windows\System\cfvZmKs.exe
  2⤵
  PID:5028
- C:\Windows\System\iHeOifp.exe
  C:\Windows\System\iHeOifp.exe
  2⤵
  PID:1876
- C:\Windows\System\OxooyHL.exe
  C:\Windows\System\OxooyHL.exe
  2⤵
  PID:3120
- C:\Windows\System\DgBWDNV.exe
  C:\Windows\System\DgBWDNV.exe
  2⤵
  PID:3468
- C:\Windows\System\kakwMUM.exe
  C:\Windows\System\kakwMUM.exe
  2⤵
  PID:4180
- C:\Windows\System\UCgxnUF.exe
  C:\Windows\System\UCgxnUF.exe
  2⤵
  PID:3964
- C:\Windows\System\kIDVJQK.exe
  C:\Windows\System\kIDVJQK.exe
  2⤵
  PID:4880
- C:\Windows\System\nDnOvkB.exe
  C:\Windows\System\nDnOvkB.exe
  2⤵
  PID:5132
- C:\Windows\System\gBYVcCE.exe
  C:\Windows\System\gBYVcCE.exe
  2⤵
  PID:5148
- C:\Windows\System\uHHzZMA.exe
  C:\Windows\System\uHHzZMA.exe
  2⤵
  PID:5164
- C:\Windows\System\yXVPdrb.exe
  C:\Windows\System\yXVPdrb.exe
  2⤵
  PID:5180
- C:\Windows\System\uffChYG.exe
  C:\Windows\System\uffChYG.exe
  2⤵
  PID:5200
- C:\Windows\System\xwOCDZH.exe
  C:\Windows\System\xwOCDZH.exe
  2⤵
  PID:5216
- C:\Windows\System\TDKPlzk.exe
  C:\Windows\System\TDKPlzk.exe
  2⤵
  PID:5232
- C:\Windows\System\cldupKg.exe
  C:\Windows\System\cldupKg.exe
  2⤵
  PID:5248
- C:\Windows\System\IYHLdWL.exe
  C:\Windows\System\IYHLdWL.exe
  2⤵
  PID:5264
- C:\Windows\System\ZFFmFLH.exe
  C:\Windows\System\ZFFmFLH.exe
  2⤵
  PID:5280
- C:\Windows\System\kPgJDas.exe
  C:\Windows\System\kPgJDas.exe
  2⤵
  PID:5316
- C:\Windows\System\ZxyaaKw.exe
  C:\Windows\System\ZxyaaKw.exe
  2⤵
  PID:5332
- C:\Windows\System\JcHrCkB.exe
  C:\Windows\System\JcHrCkB.exe
  2⤵
  PID:5348
- C:\Windows\System\aYAtAIT.exe
  C:\Windows\System\aYAtAIT.exe
  2⤵
  PID:5392
- C:\Windows\System\QvVvCeP.exe
  C:\Windows\System\QvVvCeP.exe
  2⤵
  PID:5416
- C:\Windows\System\vxYoiBo.exe
  C:\Windows\System\vxYoiBo.exe
  2⤵
  PID:5500
- C:\Windows\System\ztmhWMl.exe
  C:\Windows\System\ztmhWMl.exe
  2⤵
  PID:5528
- C:\Windows\System\pCfcKnP.exe
  C:\Windows\System\pCfcKnP.exe
  2⤵
  PID:5548
- C:\Windows\System\wqsbMSL.exe
  C:\Windows\System\wqsbMSL.exe
  2⤵
  PID:5564
- C:\Windows\System\mUNWuEz.exe
  C:\Windows\System\mUNWuEz.exe
  2⤵
  PID:5580
- C:\Windows\System\YBcsGLF.exe
  C:\Windows\System\YBcsGLF.exe
  2⤵
  PID:5596
- C:\Windows\System\eWJIPLo.exe
  C:\Windows\System\eWJIPLo.exe
  2⤵
  PID:5612
- C:\Windows\System\DrYdtqb.exe
  C:\Windows\System\DrYdtqb.exe
  2⤵
  PID:5628
- C:\Windows\System\TJNZquU.exe
  C:\Windows\System\TJNZquU.exe
  2⤵
  PID:5644
- C:\Windows\System\YpsNUDs.exe
  C:\Windows\System\YpsNUDs.exe
  2⤵
  PID:5664
- C:\Windows\System\gIyPkmB.exe
  C:\Windows\System\gIyPkmB.exe
  2⤵
  PID:5684
- C:\Windows\System\qWunRhZ.exe
  C:\Windows\System\qWunRhZ.exe
  2⤵
  PID:5700
- C:\Windows\System\pvaMvlE.exe
  C:\Windows\System\pvaMvlE.exe
  2⤵
  PID:5764
- C:\Windows\System\qoomeWa.exe
  C:\Windows\System\qoomeWa.exe
  2⤵
  PID:5780
- C:\Windows\System\HTZcEnQ.exe
  C:\Windows\System\HTZcEnQ.exe
  2⤵
  PID:5796
- C:\Windows\System\pmYgCga.exe
  C:\Windows\System\pmYgCga.exe
  2⤵
  PID:5812
- C:\Windows\System\LjVqNDt.exe
  C:\Windows\System\LjVqNDt.exe
  2⤵
  PID:5828
- C:\Windows\System\BrERHZw.exe
  C:\Windows\System\BrERHZw.exe
  2⤵
  PID:5844
- C:\Windows\System\iCdRYiR.exe
  C:\Windows\System\iCdRYiR.exe
  2⤵
  PID:5860
- C:\Windows\System\PaFskfG.exe
  C:\Windows\System\PaFskfG.exe
  2⤵
  PID:5876
- C:\Windows\System\kVSOZEu.exe
  C:\Windows\System\kVSOZEu.exe
  2⤵
  PID:5892
- C:\Windows\System\VqvfLVN.exe
  C:\Windows\System\VqvfLVN.exe
  2⤵
  PID:5908
- C:\Windows\System\BuqLjfO.exe
  C:\Windows\System\BuqLjfO.exe
  2⤵
  PID:5924
- C:\Windows\System\grWguar.exe
  C:\Windows\System\grWguar.exe
  2⤵
  PID:5940
- C:\Windows\System\dqgLTXN.exe
  C:\Windows\System\dqgLTXN.exe
  2⤵
  PID:5976
- C:\Windows\System\QXmArda.exe
  C:\Windows\System\QXmArda.exe
  2⤵
  PID:5992
- C:\Windows\System\PcpdrYN.exe
  C:\Windows\System\PcpdrYN.exe
  2⤵
  PID:6008
- C:\Windows\System\uOQyvKx.exe
  C:\Windows\System\uOQyvKx.exe
  2⤵
  PID:6028
- C:\Windows\System\LPmeMTc.exe
  C:\Windows\System\LPmeMTc.exe
  2⤵
  PID:6044
- C:\Windows\System\cJnIJAc.exe
  C:\Windows\System\cJnIJAc.exe
  2⤵
  PID:6060
- C:\Windows\System\XiJLBqr.exe
  C:\Windows\System\XiJLBqr.exe
  2⤵
  PID:6076
- C:\Windows\System\KZZOdaF.exe
  C:\Windows\System\KZZOdaF.exe
  2⤵
  PID:6092
- C:\Windows\System\Yqdsbvg.exe
  C:\Windows\System\Yqdsbvg.exe
  2⤵
  PID:6108
- C:\Windows\System\HAraySN.exe
  C:\Windows\System\HAraySN.exe
  2⤵
  PID:6124
- C:\Windows\System\WhCdRrH.exe
  C:\Windows\System\WhCdRrH.exe
  2⤵
  PID:4532
- C:\Windows\System\gkrkTCE.exe
  C:\Windows\System\gkrkTCE.exe
  2⤵
  PID:4600
- C:\Windows\System\fVkqRjV.exe
  C:\Windows\System\fVkqRjV.exe
  2⤵
  PID:5128
- C:\Windows\System\jfdSbVr.exe
  C:\Windows\System\jfdSbVr.exe
  2⤵
  PID:3900
- C:\Windows\System\XArZUyf.exe
  C:\Windows\System\XArZUyf.exe
  2⤵
  PID:2084
- C:\Windows\System\tqwzprb.exe
  C:\Windows\System\tqwzprb.exe
  2⤵
  PID:5192
- C:\Windows\System\NkaAAIc.exe
  C:\Windows\System\NkaAAIc.exe
  2⤵
  PID:5224
- C:\Windows\System\wkKpukz.exe
  C:\Windows\System\wkKpukz.exe
  2⤵
  PID:5288
- C:\Windows\System\vMeVfeV.exe
  C:\Windows\System\vMeVfeV.exe
  2⤵
  PID:1208
- C:\Windows\System\NseEiTz.exe
  C:\Windows\System\NseEiTz.exe
  2⤵
  PID:4768
- C:\Windows\System\zLkUDOv.exe
  C:\Windows\System\zLkUDOv.exe
  2⤵
  PID:5144
- C:\Windows\System\CTCCYKx.exe
  C:\Windows\System\CTCCYKx.exe
  2⤵
  PID:5356
- C:\Windows\System\tisLlEV.exe
  C:\Windows\System\tisLlEV.exe
  2⤵
  PID:5360
- C:\Windows\System\EpbCgfH.exe
  C:\Windows\System\EpbCgfH.exe
  2⤵
  PID:5372
- C:\Windows\System\LaONxue.exe
  C:\Windows\System\LaONxue.exe
  2⤵
  PID:5408
- C:\Windows\System\gYavcuz.exe
  C:\Windows\System\gYavcuz.exe
  2⤵
  PID:5436
- C:\Windows\System\NSqydJo.exe
  C:\Windows\System\NSqydJo.exe
  2⤵
  PID:5452
- C:\Windows\System\zHcJtcE.exe
  C:\Windows\System\zHcJtcE.exe
  2⤵
  PID:5468
- C:\Windows\System\dLABnNt.exe
  C:\Windows\System\dLABnNt.exe
  2⤵
  PID:5484
- C:\Windows\System\dBiNBOC.exe
  C:\Windows\System\dBiNBOC.exe
  2⤵
  PID:5508
- C:\Windows\System\OLCGMeM.exe
  C:\Windows\System\OLCGMeM.exe
  2⤵
  PID:2864
- C:\Windows\System\xMJzMPz.exe
  C:\Windows\System\xMJzMPz.exe
  2⤵
  PID:5544
- C:\Windows\System\cJXCBKS.exe
  C:\Windows\System\cJXCBKS.exe
  2⤵
  PID:5624
- C:\Windows\System\FHAARmD.exe
  C:\Windows\System\FHAARmD.exe
  2⤵
  PID:5656
- C:\Windows\System\msZmWOy.exe
  C:\Windows\System\msZmWOy.exe
  2⤵
  PID:5572
- C:\Windows\System\ePemcAF.exe
  C:\Windows\System\ePemcAF.exe
  2⤵
  PID:5608
- C:\Windows\System\QuznAZY.exe
  C:\Windows\System\QuznAZY.exe
  2⤵
  PID:5712
- C:\Windows\System\eQTccJr.exe
  C:\Windows\System\eQTccJr.exe
  2⤵
  PID:5720
- C:\Windows\System\dpdemFy.exe
  C:\Windows\System\dpdemFy.exe
  2⤵
  PID:5744
- C:\Windows\System\XOmGlqa.exe
  C:\Windows\System\XOmGlqa.exe
  2⤵
  PID:5752
- C:\Windows\System\kAbPHMI.exe
  C:\Windows\System\kAbPHMI.exe
  2⤵
  PID:5792
- C:\Windows\System\UfUwCIN.exe
  C:\Windows\System\UfUwCIN.exe
  2⤵
  PID:5776
- C:\Windows\System\GITgnUQ.exe
  C:\Windows\System\GITgnUQ.exe
  2⤵
  PID:5840
- C:\Windows\System\OfxfGXu.exe
  C:\Windows\System\OfxfGXu.exe
  2⤵
  PID:5872
- C:\Windows\System\crOaPws.exe
  C:\Windows\System\crOaPws.exe
  2⤵
  PID:5916
- C:\Windows\System\NrkCDOI.exe
  C:\Windows\System\NrkCDOI.exe
  2⤵
  PID:6020
- C:\Windows\System\glUmAlj.exe
  C:\Windows\System\glUmAlj.exe
  2⤵
  PID:6088
- C:\Windows\System\UYsWVum.exe
  C:\Windows\System\UYsWVum.exe
  2⤵
  PID:6024
- C:\Windows\System\GjVModS.exe
  C:\Windows\System\GjVModS.exe
  2⤵
  PID:4544
- C:\Windows\System\jfgeNOv.exe
  C:\Windows\System\jfgeNOv.exe
  2⤵
  PID:4700
- C:\Windows\System\JTEZDmM.exe
  C:\Windows\System\JTEZDmM.exe
  2⤵
  PID:6036
- C:\Windows\System\JhIJGQZ.exe
  C:\Windows\System\JhIJGQZ.exe
  2⤵
  PID:5956
- C:\Windows\System\JiOfAKJ.exe
  C:\Windows\System\JiOfAKJ.exe
  2⤵
  PID:5972
- C:\Windows\System\eWymhOx.exe
  C:\Windows\System\eWymhOx.exe
  2⤵
  PID:5188
- C:\Windows\System\WfIhoAR.exe
  C:\Windows\System\WfIhoAR.exe
  2⤵
  PID:5412
- C:\Windows\System\mxduyoz.exe
  C:\Windows\System\mxduyoz.exe
  2⤵
  PID:5036
- C:\Windows\System\UyGlVFi.exe
  C:\Windows\System\UyGlVFi.exe
  2⤵
  PID:5212
- C:\Windows\System\JRLeIlX.exe
  C:\Windows\System\JRLeIlX.exe
  2⤵
  PID:5296
- C:\Windows\System\KlvWKvi.exe
  C:\Windows\System\KlvWKvi.exe
  2⤵
  PID:5304
- C:\Windows\System\CKtZQYq.exe
  C:\Windows\System\CKtZQYq.exe
  2⤵
  PID:5368
- C:\Windows\System\YkTJDvC.exe
  C:\Windows\System\YkTJDvC.exe
  2⤵
  PID:5460
- C:\Windows\System\agZJjnV.exe
  C:\Windows\System\agZJjnV.exe
  2⤵
  PID:5520
- C:\Windows\System\CkqIdTi.exe
  C:\Windows\System\CkqIdTi.exe
  2⤵
  PID:5696
- C:\Windows\System\aaCYhhE.exe
  C:\Windows\System\aaCYhhE.exe
  2⤵
  PID:5716
- C:\Windows\System\dwTohrx.exe
  C:\Windows\System\dwTohrx.exe
  2⤵
  PID:5292
- C:\Windows\System\ymsLzVy.exe
  C:\Windows\System\ymsLzVy.exe
  2⤵
  PID:5156
- C:\Windows\System\iCvKnzk.exe
  C:\Windows\System\iCvKnzk.exe
  2⤵
  PID:5388
- C:\Windows\System\FEPEKHN.exe
  C:\Windows\System\FEPEKHN.exe
  2⤵
  PID:5772
- C:\Windows\System\VuOOfAp.exe
  C:\Windows\System\VuOOfAp.exe
  2⤵
  PID:5384
- C:\Windows\System\NnIyDpZ.exe
  C:\Windows\System\NnIyDpZ.exe
  2⤵
  PID:5480
- C:\Windows\System\lAAfyhb.exe
  C:\Windows\System\lAAfyhb.exe
  2⤵
  PID:5540
- C:\Windows\System\jDgzXbn.exe
  C:\Windows\System\jDgzXbn.exe
  2⤵
  PID:5760
- C:\Windows\System\sFblAgw.exe
  C:\Windows\System\sFblAgw.exe
  2⤵
  PID:6056
- C:\Windows\System\wcheHci.exe
  C:\Windows\System\wcheHci.exe
  2⤵
  PID:5952
- C:\Windows\System\Tlflnai.exe
  C:\Windows\System\Tlflnai.exe
  2⤵
  PID:5824
- C:\Windows\System\GZQgoBP.exe
  C:\Windows\System\GZQgoBP.exe
  2⤵
  PID:5276
- C:\Windows\System\bsLEBrG.exe
  C:\Windows\System\bsLEBrG.exe
  2⤵
  PID:6140
- C:\Windows\System\zWIXIJG.exe
  C:\Windows\System\zWIXIJG.exe
  2⤵
  PID:4012
- C:\Windows\System\qmvbSkV.exe
  C:\Windows\System\qmvbSkV.exe
  2⤵
  PID:5960
- C:\Windows\System\CpwQupb.exe
  C:\Windows\System\CpwQupb.exe
  2⤵
  PID:6104
- C:\Windows\System\oEyUXjM.exe
  C:\Windows\System\oEyUXjM.exe
  2⤵
  PID:3684
- C:\Windows\System\kqcQKXq.exe
  C:\Windows\System\kqcQKXq.exe
  2⤵
  PID:4152
- C:\Windows\System\mfyxBDr.exe
  C:\Windows\System\mfyxBDr.exe
  2⤵
  PID:5208
- C:\Windows\System\dVkvcJc.exe
  C:\Windows\System\dVkvcJc.exe
  2⤵
  PID:5340
- C:\Windows\System\OHfriFi.exe
  C:\Windows\System\OHfriFi.exe
  2⤵
  PID:5576
- C:\Windows\System\CAxTRCu.exe
  C:\Windows\System\CAxTRCu.exe
  2⤵
  PID:5476
- C:\Windows\System\bnKrdfO.exe
  C:\Windows\System\bnKrdfO.exe
  2⤵
  PID:6072
- C:\Windows\System\CyuWavH.exe
  C:\Windows\System\CyuWavH.exe
  2⤵
  PID:4960
- C:\Windows\System\rNmelhX.exe
  C:\Windows\System\rNmelhX.exe
  2⤵
  PID:5244
- C:\Windows\System\bCdbrxX.exe
  C:\Windows\System\bCdbrxX.exe
  2⤵
  PID:4328
- C:\Windows\System\ZqcaLYv.exe
  C:\Windows\System\ZqcaLYv.exe
  2⤵
  PID:5920
- C:\Windows\System\NTwJtPY.exe
  C:\Windows\System\NTwJtPY.exe
  2⤵
  PID:5808
- C:\Windows\System\OozDncg.exe
  C:\Windows\System\OozDncg.exe
  2⤵
  PID:6016
- C:\Windows\System\NvvnYNO.exe
  C:\Windows\System\NvvnYNO.exe
  2⤵
  PID:5948
- C:\Windows\System\lSTwfKO.exe
  C:\Windows\System\lSTwfKO.exe
  2⤵
  PID:5708
- C:\Windows\System\nggDhbl.exe
  C:\Windows\System\nggDhbl.exe
  2⤵
  PID:5904
- C:\Windows\System\stHIdOo.exe
  C:\Windows\System\stHIdOo.exe
  2⤵
  PID:5676
- C:\Windows\System\dSAcHaq.exe
  C:\Windows\System\dSAcHaq.exe
  2⤵
  PID:4844
- C:\Windows\System\TOkOgGL.exe
  C:\Windows\System\TOkOgGL.exe
  2⤵
  PID:5272
- C:\Windows\System\qHhYttX.exe
  C:\Windows\System\qHhYttX.exe
  2⤵
  PID:5260
- C:\Windows\System\qKkTUwv.exe
  C:\Windows\System\qKkTUwv.exe
  2⤵
  PID:5312
- C:\Windows\System\vIOKkWa.exe
  C:\Windows\System\vIOKkWa.exe
  2⤵
  PID:2784
- C:\Windows\System\avUtCpe.exe
  C:\Windows\System\avUtCpe.exe
  2⤵
  PID:6148
- C:\Windows\System\yIDQFrL.exe
  C:\Windows\System\yIDQFrL.exe
  2⤵
  PID:6164
- C:\Windows\System\fIwPjCc.exe
  C:\Windows\System\fIwPjCc.exe
  2⤵
  PID:6180
- C:\Windows\System\dXOrgQi.exe
  C:\Windows\System\dXOrgQi.exe
  2⤵
  PID:6196
- C:\Windows\System\nFwQguY.exe
  C:\Windows\System\nFwQguY.exe
  2⤵
  PID:6212
- C:\Windows\System\zMFeivV.exe
  C:\Windows\System\zMFeivV.exe
  2⤵
  PID:6228
- C:\Windows\System\SKTlZco.exe
  C:\Windows\System\SKTlZco.exe
  2⤵
  PID:6244
- C:\Windows\System\TXKKPTE.exe
  C:\Windows\System\TXKKPTE.exe
  2⤵
  PID:6260
- C:\Windows\System\QtFlXVT.exe
  C:\Windows\System\QtFlXVT.exe
  2⤵
  PID:6276
- C:\Windows\System\ZIoDbPL.exe
  C:\Windows\System\ZIoDbPL.exe
  2⤵
  PID:6292
- C:\Windows\System\KtzxavU.exe
  C:\Windows\System\KtzxavU.exe
  2⤵
  PID:6308
- C:\Windows\System\wQNDvto.exe
  C:\Windows\System\wQNDvto.exe
  2⤵
  PID:6328
- C:\Windows\System\FpBasDW.exe
  C:\Windows\System\FpBasDW.exe
  2⤵
  PID:6348
- C:\Windows\System\utvFyhp.exe
  C:\Windows\System\utvFyhp.exe
  2⤵
  PID:6364
- C:\Windows\System\QnNPHjR.exe
  C:\Windows\System\QnNPHjR.exe
  2⤵
  PID:6380
- C:\Windows\System\LAusfFn.exe
  C:\Windows\System\LAusfFn.exe
  2⤵
  PID:6396
- C:\Windows\System\DYSkoMO.exe
  C:\Windows\System\DYSkoMO.exe
  2⤵
  PID:6412
- C:\Windows\System\vlOxuga.exe
  C:\Windows\System\vlOxuga.exe
  2⤵
  PID:6428
- C:\Windows\System\PBpZAGr.exe
  C:\Windows\System\PBpZAGr.exe
  2⤵
  PID:6448
- C:\Windows\System\ZdOmLqA.exe
  C:\Windows\System\ZdOmLqA.exe
  2⤵
  PID:6464
- C:\Windows\System\dRJfVdp.exe
  C:\Windows\System\dRJfVdp.exe
  2⤵
  PID:6480
- C:\Windows\System\LmokHAm.exe
  C:\Windows\System\LmokHAm.exe
  2⤵
  PID:6496
- C:\Windows\System\jJMpZWJ.exe
  C:\Windows\System\jJMpZWJ.exe
  2⤵
  PID:6512
- C:\Windows\System\ZKViVAl.exe
  C:\Windows\System\ZKViVAl.exe
  2⤵
  PID:6536
- C:\Windows\System\VCleuCl.exe
  C:\Windows\System\VCleuCl.exe
  2⤵
  PID:6552
- C:\Windows\System\sXhzGEb.exe
  C:\Windows\System\sXhzGEb.exe
  2⤵
  PID:6568
- C:\Windows\System\azEKOei.exe
  C:\Windows\System\azEKOei.exe
  2⤵
  PID:6584
- C:\Windows\System\szHtbiQ.exe
  C:\Windows\System\szHtbiQ.exe
  2⤵
  PID:6600
- C:\Windows\System\IXhwEDc.exe
  C:\Windows\System\IXhwEDc.exe
  2⤵
  PID:6616
- C:\Windows\System\FygfgjB.exe
  C:\Windows\System\FygfgjB.exe
  2⤵
  PID:6636
- C:\Windows\System\LzvKnOx.exe
  C:\Windows\System\LzvKnOx.exe
  2⤵
  PID:6652
- C:\Windows\System\gyMxpYN.exe
  C:\Windows\System\gyMxpYN.exe
  2⤵
  PID:6672
- C:\Windows\System\sauoWrH.exe
  C:\Windows\System\sauoWrH.exe
  2⤵
  PID:6692
- C:\Windows\System\vNHPFkq.exe
  C:\Windows\System\vNHPFkq.exe
  2⤵
  PID:6708
- C:\Windows\System\xVboMag.exe
  C:\Windows\System\xVboMag.exe
  2⤵
  PID:6724
- C:\Windows\System\vVMddXx.exe
  C:\Windows\System\vVMddXx.exe
  2⤵
  PID:6748
- C:\Windows\System\HDItZqv.exe
  C:\Windows\System\HDItZqv.exe
  2⤵
  PID:6764
- C:\Windows\System\xbmdIii.exe
  C:\Windows\System\xbmdIii.exe
  2⤵
  PID:6780
- C:\Windows\System\WeuFtPI.exe
  C:\Windows\System\WeuFtPI.exe
  2⤵
  PID:6796
- C:\Windows\System\TNZhvUh.exe
  C:\Windows\System\TNZhvUh.exe
  2⤵
  PID:6812
- C:\Windows\System\qcBDDPq.exe
  C:\Windows\System\qcBDDPq.exe
  2⤵
  PID:6828
- C:\Windows\System\uGYRkch.exe
  C:\Windows\System\uGYRkch.exe
  2⤵
  PID:6844
- C:\Windows\System\lVZircl.exe
  C:\Windows\System\lVZircl.exe
  2⤵
  PID:6860
- C:\Windows\System\jGSqyPy.exe
  C:\Windows\System\jGSqyPy.exe
  2⤵
  PID:6876
- C:\Windows\System\XIuYIAU.exe
  C:\Windows\System\XIuYIAU.exe
  2⤵
  PID:6892
- C:\Windows\System\qYcXKpm.exe
  C:\Windows\System\qYcXKpm.exe
  2⤵
  PID:6908
- C:\Windows\System\cGniFhX.exe
  C:\Windows\System\cGniFhX.exe
  2⤵
  PID:6924
- C:\Windows\System\EgKlNAi.exe
  C:\Windows\System\EgKlNAi.exe
  2⤵
  PID:6940
- C:\Windows\System\uMbNssi.exe
  C:\Windows\System\uMbNssi.exe
  2⤵
  PID:6956
- C:\Windows\System\ciFGRTC.exe
  C:\Windows\System\ciFGRTC.exe
  2⤵
  PID:6972
- C:\Windows\System\IMUinMM.exe
  C:\Windows\System\IMUinMM.exe
  2⤵
  PID:6988
- C:\Windows\System\KoYbyMm.exe
  C:\Windows\System\KoYbyMm.exe
  2⤵
  PID:7004
- C:\Windows\System\nASHLkr.exe
  C:\Windows\System\nASHLkr.exe
  2⤵
  PID:7020
- C:\Windows\System\ITdmUEs.exe
  C:\Windows\System\ITdmUEs.exe
  2⤵
  PID:7036
- C:\Windows\System\TJOIEIF.exe
  C:\Windows\System\TJOIEIF.exe
  2⤵
  PID:7052
- C:\Windows\System\qJvuXkm.exe
  C:\Windows\System\qJvuXkm.exe
  2⤵
  PID:7068
- C:\Windows\System\oaXXGcH.exe
  C:\Windows\System\oaXXGcH.exe
  2⤵
  PID:7084
- C:\Windows\System\oPIaiFR.exe
  C:\Windows\System\oPIaiFR.exe
  2⤵
  PID:7100
- C:\Windows\System\iFensYq.exe
  C:\Windows\System\iFensYq.exe
  2⤵
  PID:7116
- C:\Windows\System\fPEtifX.exe
  C:\Windows\System\fPEtifX.exe
  2⤵
  PID:7136
- C:\Windows\System\eeMRjXm.exe
  C:\Windows\System\eeMRjXm.exe
  2⤵
  PID:7152
- C:\Windows\System\STDsUsh.exe
  C:\Windows\System\STDsUsh.exe
  2⤵
  PID:5432
- C:\Windows\System\jpxfBYX.exe
  C:\Windows\System\jpxfBYX.exe
  2⤵
  PID:6192
- C:\Windows\System\ixiWPRo.exe
  C:\Windows\System\ixiWPRo.exe
  2⤵
  PID:5364
- C:\Windows\System\vtMZqIO.exe
  C:\Windows\System\vtMZqIO.exe
  2⤵
  PID:6172
- C:\Windows\System\vFYubBG.exe
  C:\Windows\System\vFYubBG.exe
  2⤵
  PID:6252
- C:\Windows\System\WBTlbaU.exe
  C:\Windows\System\WBTlbaU.exe
  2⤵
  PID:6284
- C:\Windows\System\siduXFe.exe
  C:\Windows\System\siduXFe.exe
  2⤵
  PID:6272
- C:\Windows\System\GxlLnAq.exe
  C:\Windows\System\GxlLnAq.exe
  2⤵
  PID:6356
- C:\Windows\System\MKTKeOQ.exe
  C:\Windows\System\MKTKeOQ.exe
  2⤵
  PID:6420
- C:\Windows\System\SjQUkdy.exe
  C:\Windows\System\SjQUkdy.exe
  2⤵
  PID:6488
- C:\Windows\System\viOkuLH.exe
  C:\Windows\System\viOkuLH.exe
  2⤵
  PID:6560
- C:\Windows\System\pBApuwr.exe
  C:\Windows\System\pBApuwr.exe
  2⤵
  PID:6628
- C:\Windows\System\hSlLiYy.exe
  C:\Windows\System\hSlLiYy.exe
  2⤵
  PID:6268
- C:\Windows\System\nUDwOIX.exe
  C:\Windows\System\nUDwOIX.exe
  2⤵
  PID:6660
- C:\Windows\System\hYJXKRw.exe
  C:\Windows\System\hYJXKRw.exe
  2⤵
  PID:6704
- C:\Windows\System\caXvxNG.exe
  C:\Windows\System\caXvxNG.exe
  2⤵
  PID:6372
- C:\Windows\System\XageZpx.exe
  C:\Windows\System\XageZpx.exe
  2⤵
  PID:6336
- C:\Windows\System\WXFBIhj.exe
  C:\Windows\System\WXFBIhj.exe
  2⤵
  PID:6440
- C:\Windows\System\BwkPhnu.exe
  C:\Windows\System\BwkPhnu.exe
  2⤵
  PID:6508
- C:\Windows\System\ImFBenL.exe
  C:\Windows\System\ImFBenL.exe
  2⤵
  PID:6548
- C:\Windows\System\qpHXYxv.exe
  C:\Windows\System\qpHXYxv.exe
  2⤵
  PID:6612
- C:\Windows\System\eQzHqmM.exe
  C:\Windows\System\eQzHqmM.exe
  2⤵
  PID:6684
- C:\Windows\System\jHNOvnI.exe
  C:\Windows\System\jHNOvnI.exe
  2⤵
  PID:6772
- C:\Windows\System\jdvHhfL.exe
  C:\Windows\System\jdvHhfL.exe
  2⤵
  PID:6744
- C:\Windows\System\kXMAyWi.exe
  C:\Windows\System\kXMAyWi.exe
  2⤵
  PID:6760
- C:\Windows\System\KpBslqZ.exe
  C:\Windows\System\KpBslqZ.exe
  2⤵
  PID:6852
- C:\Windows\System\whATvoG.exe
  C:\Windows\System\whATvoG.exe
  2⤵
  PID:6856
- C:\Windows\System\hQCGrAR.exe
  C:\Windows\System\hQCGrAR.exe
  2⤵
  PID:6884
- C:\Windows\System\Qnwfkrf.exe
  C:\Windows\System\Qnwfkrf.exe
  2⤵
  PID:6932
- C:\Windows\System\NOEOirm.exe
  C:\Windows\System\NOEOirm.exe
  2⤵
  PID:6964
- C:\Windows\System\cwRnwPk.exe
  C:\Windows\System\cwRnwPk.exe
  2⤵
  PID:6984
- C:\Windows\System\VvzgGsi.exe
  C:\Windows\System\VvzgGsi.exe
  2⤵
  PID:7080
- C:\Windows\System\thnIxyY.exe
  C:\Windows\System\thnIxyY.exe
  2⤵
  PID:7032
- C:\Windows\System\InoGcUi.exe
  C:\Windows\System\InoGcUi.exe
  2⤵
  PID:7092
- C:\Windows\System\TRRKanG.exe
  C:\Windows\System\TRRKanG.exe
  2⤵
  PID:7148
- C:\Windows\System\MtubGjf.exe
  C:\Windows\System\MtubGjf.exe
  2⤵
  PID:7132
- C:\Windows\System\yZGnVyw.exe
  C:\Windows\System\yZGnVyw.exe
  2⤵
  PID:5012
- C:\Windows\System\amlBHkk.exe
  C:\Windows\System\amlBHkk.exe
  2⤵
  PID:6220
- C:\Windows\System\eeCMxDG.exe
  C:\Windows\System\eeCMxDG.exe
  2⤵
  PID:6388
- C:\Windows\System\awBYQXi.exe
  C:\Windows\System\awBYQXi.exe
  2⤵
  PID:6236
- C:\Windows\System\ERjEDaV.exe
  C:\Windows\System\ERjEDaV.exe
  2⤵
  PID:6408
- C:\Windows\System\kWuKDVJ.exe
  C:\Windows\System\kWuKDVJ.exe
  2⤵
  PID:6580
- C:\Windows\System\tGkiKpF.exe
  C:\Windows\System\tGkiKpF.exe
  2⤵
  PID:6808
- C:\Windows\System\fyGsbtQ.exe
  C:\Windows\System\fyGsbtQ.exe
  2⤵
  PID:6980
- C:\Windows\System\FqFlPAK.exe
  C:\Windows\System\FqFlPAK.exe
  2⤵
  PID:7164
- C:\Windows\System\SmyqhER.exe
  C:\Windows\System\SmyqhER.exe
  2⤵
  PID:6208
- C:\Windows\System\xFBUsbd.exe
  C:\Windows\System\xFBUsbd.exe
  2⤵
  PID:6376
- C:\Windows\System\MYCPkqv.exe
  C:\Windows\System\MYCPkqv.exe
  2⤵
  PID:6544
- C:\Windows\System\krHKzoU.exe
  C:\Windows\System\krHKzoU.exe
  2⤵
  PID:7064
- C:\Windows\System\Gvbtexe.exe
  C:\Windows\System\Gvbtexe.exe
  2⤵
  PID:5196
- C:\Windows\System\nmpWnVT.exe
  C:\Windows\System\nmpWnVT.exe
  2⤵
  PID:6320
- C:\Windows\System\KapYOUj.exe
  C:\Windows\System\KapYOUj.exe
  2⤵
  PID:7128
- C:\Windows\System\FldqNQy.exe
  C:\Windows\System\FldqNQy.exe
  2⤵
  PID:6740
- C:\Windows\System\GYxnVVC.exe
  C:\Windows\System\GYxnVVC.exe
  2⤵
  PID:6836
- C:\Windows\System\AMMfPbK.exe
  C:\Windows\System\AMMfPbK.exe
  2⤵
  PID:7016
- C:\Windows\System\FdcLYxN.exe
  C:\Windows\System\FdcLYxN.exe
  2⤵
  PID:5496
- C:\Windows\System\klkSZgM.exe
  C:\Windows\System\klkSZgM.exe
  2⤵
  PID:6792
- C:\Windows\System\jUxViwp.exe
  C:\Windows\System\jUxViwp.exe
  2⤵
  PID:6920
- C:\Windows\System\MVkeUNn.exe
  C:\Windows\System\MVkeUNn.exe
  2⤵
  PID:7108
- C:\Windows\System\BPhwYRZ.exe
  C:\Windows\System\BPhwYRZ.exe
  2⤵
  PID:6700
- C:\Windows\System\csLVZPH.exe
  C:\Windows\System\csLVZPH.exe
  2⤵
  PID:6632
- C:\Windows\System\ZjmQKAZ.exe
  C:\Windows\System\ZjmQKAZ.exe
  2⤵
  PID:6304
- C:\Windows\System\lONsmBW.exe
  C:\Windows\System\lONsmBW.exe
  2⤵
  PID:6204
- C:\Windows\System\ldIjIMA.exe
  C:\Windows\System\ldIjIMA.exe
  2⤵
  PID:2028
- C:\Windows\System\LsjSrib.exe
  C:\Windows\System\LsjSrib.exe
  2⤵
  PID:5964
- C:\Windows\System\kiqfnFq.exe
  C:\Windows\System\kiqfnFq.exe
  2⤵
  PID:7028
- C:\Windows\System\CfhMCuP.exe
  C:\Windows\System\CfhMCuP.exe
  2⤵
  PID:6968
- C:\Windows\System\FBjvtKS.exe
  C:\Windows\System\FBjvtKS.exe
  2⤵
  PID:6344
- C:\Windows\System\kRVcdPP.exe
  C:\Windows\System\kRVcdPP.exe
  2⤵
  PID:6596
- C:\Windows\System\eqQAVIN.exe
  C:\Windows\System\eqQAVIN.exe
  2⤵
  PID:2056
- C:\Windows\System\TYrpDPM.exe
  C:\Windows\System\TYrpDPM.exe
  2⤵
  PID:6456
- C:\Windows\System\ZwTafjS.exe
  C:\Windows\System\ZwTafjS.exe
  2⤵
  PID:6868
- C:\Windows\System\ywnfEUM.exe
  C:\Windows\System\ywnfEUM.exe
  2⤵
  PID:7184
- C:\Windows\System\OfOHhWG.exe
  C:\Windows\System\OfOHhWG.exe
  2⤵
  PID:7200
- C:\Windows\System\nrsLwaC.exe
  C:\Windows\System\nrsLwaC.exe
  2⤵
  PID:7216
- C:\Windows\System\THdczyO.exe
  C:\Windows\System\THdczyO.exe
  2⤵
  PID:7232
- C:\Windows\System\bvxLZSk.exe
  C:\Windows\System\bvxLZSk.exe
  2⤵
  PID:7248
- C:\Windows\System\GfpYObB.exe
  C:\Windows\System\GfpYObB.exe
  2⤵
  PID:7264
- C:\Windows\System\dKSebid.exe
  C:\Windows\System\dKSebid.exe
  2⤵
  PID:7280
- C:\Windows\System\DOdXkTI.exe
  C:\Windows\System\DOdXkTI.exe
  2⤵
  PID:7296
- C:\Windows\System\ODUFHTd.exe
  C:\Windows\System\ODUFHTd.exe
  2⤵
  PID:7312
- C:\Windows\System\MSxwhUD.exe
  C:\Windows\System\MSxwhUD.exe
  2⤵
  PID:7328
- C:\Windows\System\oXEYJbZ.exe
  C:\Windows\System\oXEYJbZ.exe
  2⤵
  PID:7344
- C:\Windows\System\jMKvgQM.exe
  C:\Windows\System\jMKvgQM.exe
  2⤵
  PID:7360
- C:\Windows\System\pDFkuCX.exe
  C:\Windows\System\pDFkuCX.exe
  2⤵
  PID:7380
- C:\Windows\System\zNqfkBZ.exe
  C:\Windows\System\zNqfkBZ.exe
  2⤵
  PID:7396
- C:\Windows\System\QlQVxdR.exe
  C:\Windows\System\QlQVxdR.exe
  2⤵
  PID:7412
- C:\Windows\System\BrlHaWi.exe
  C:\Windows\System\BrlHaWi.exe
  2⤵
  PID:7428
- C:\Windows\System\fxOarAf.exe
  C:\Windows\System\fxOarAf.exe
  2⤵
  PID:7444
- C:\Windows\System\XzSuJfM.exe
  C:\Windows\System\XzSuJfM.exe
  2⤵
  PID:7460
- C:\Windows\System\NVxHEye.exe
  C:\Windows\System\NVxHEye.exe
  2⤵
  PID:7476
- C:\Windows\System\mzJEGsd.exe
  C:\Windows\System\mzJEGsd.exe
  2⤵
  PID:7496
- C:\Windows\System\cOIFbHi.exe
  C:\Windows\System\cOIFbHi.exe
  2⤵
  PID:7512
- C:\Windows\System\QBdYmvr.exe
  C:\Windows\System\QBdYmvr.exe
  2⤵
  PID:7528
- C:\Windows\System\LDMxTJm.exe
  C:\Windows\System\LDMxTJm.exe
  2⤵
  PID:7544
- C:\Windows\System\dVFNJBr.exe
  C:\Windows\System\dVFNJBr.exe
  2⤵
  PID:7560
- C:\Windows\System\fdMehXp.exe
  C:\Windows\System\fdMehXp.exe
  2⤵
  PID:7576
- C:\Windows\System\whJNPPK.exe
  C:\Windows\System\whJNPPK.exe
  2⤵
  PID:7592
- C:\Windows\System\wBdorwP.exe
  C:\Windows\System\wBdorwP.exe
  2⤵
  PID:7608
- C:\Windows\System\lcYgQev.exe
  C:\Windows\System\lcYgQev.exe
  2⤵
  PID:7624
- C:\Windows\System\QYBKqwU.exe
  C:\Windows\System\QYBKqwU.exe
  2⤵
  PID:7640
- C:\Windows\System\BcBLRAN.exe
  C:\Windows\System\BcBLRAN.exe
  2⤵
  PID:7656
- C:\Windows\System\ZNAGpLR.exe
  C:\Windows\System\ZNAGpLR.exe
  2⤵
  PID:7672
- C:\Windows\System\EUWuUwr.exe
  C:\Windows\System\EUWuUwr.exe
  2⤵
  PID:7688
- C:\Windows\System\dgWwllU.exe
  C:\Windows\System\dgWwllU.exe
  2⤵
  PID:7704
- C:\Windows\System\hhhfOOR.exe
  C:\Windows\System\hhhfOOR.exe
  2⤵
  PID:7720
- C:\Windows\System\wCZrMxs.exe
  C:\Windows\System\wCZrMxs.exe
  2⤵
  PID:7736
- C:\Windows\System\iagEieu.exe
  C:\Windows\System\iagEieu.exe
  2⤵
  PID:7752
- C:\Windows\System\nkthkAU.exe
  C:\Windows\System\nkthkAU.exe
  2⤵
  PID:7768
- C:\Windows\System\loZjGDW.exe
  C:\Windows\System\loZjGDW.exe
  2⤵
  PID:7784
- C:\Windows\System\HbbSrYp.exe
  C:\Windows\System\HbbSrYp.exe
  2⤵
  PID:7800
- C:\Windows\System\QrmJOsU.exe
  C:\Windows\System\QrmJOsU.exe
  2⤵
  PID:7816
- C:\Windows\System\ovvlfqW.exe
  C:\Windows\System\ovvlfqW.exe
  2⤵
  PID:7832
- C:\Windows\System\TIHnIyX.exe
  C:\Windows\System\TIHnIyX.exe
  2⤵
  PID:7848
- C:\Windows\System\aAyfVRM.exe
  C:\Windows\System\aAyfVRM.exe
  2⤵
  PID:7864
- C:\Windows\System\ntFhUqw.exe
  C:\Windows\System\ntFhUqw.exe
  2⤵
  PID:7880
- C:\Windows\System\xyQGfCd.exe
  C:\Windows\System\xyQGfCd.exe
  2⤵
  PID:7896
- C:\Windows\System\BVHtyVP.exe
  C:\Windows\System\BVHtyVP.exe
  2⤵
  PID:7912
- C:\Windows\System\FvXiZwF.exe
  C:\Windows\System\FvXiZwF.exe
  2⤵
  PID:7928
- C:\Windows\System\WEWSlaC.exe
  C:\Windows\System\WEWSlaC.exe
  2⤵
  PID:7944
- C:\Windows\System\BDSiyGt.exe
  C:\Windows\System\BDSiyGt.exe
  2⤵
  PID:7960
- C:\Windows\System\WKgRBFj.exe
  C:\Windows\System\WKgRBFj.exe
  2⤵
  PID:7976
- C:\Windows\System\HBgxlcH.exe
  C:\Windows\System\HBgxlcH.exe
  2⤵
  PID:7992
- C:\Windows\System\elBmBRz.exe
  C:\Windows\System\elBmBRz.exe
  2⤵
  PID:8008
- C:\Windows\System\DIHkcFX.exe
  C:\Windows\System\DIHkcFX.exe
  2⤵
  PID:8024
- C:\Windows\System\CZFjngj.exe
  C:\Windows\System\CZFjngj.exe
  2⤵
  PID:8040
- C:\Windows\System\eVZErXj.exe
  C:\Windows\System\eVZErXj.exe
  2⤵
  PID:8056
- C:\Windows\System\WOACZRX.exe
  C:\Windows\System\WOACZRX.exe
  2⤵
  PID:8072
- C:\Windows\System\WKVJkyl.exe
  C:\Windows\System\WKVJkyl.exe
  2⤵
  PID:8088
- C:\Windows\System\LqbyaiK.exe
  C:\Windows\System\LqbyaiK.exe
  2⤵
  PID:8104
- C:\Windows\System\PFynQee.exe
  C:\Windows\System\PFynQee.exe
  2⤵
  PID:8120
- C:\Windows\System\JwEujSi.exe
  C:\Windows\System\JwEujSi.exe
  2⤵
  PID:8136
- C:\Windows\System\wHixlqW.exe
  C:\Windows\System\wHixlqW.exe
  2⤵
  PID:8152
- C:\Windows\System\owHBrul.exe
  C:\Windows\System\owHBrul.exe
  2⤵
  PID:8168
- C:\Windows\System\cgRvkiJ.exe
  C:\Windows\System\cgRvkiJ.exe
  2⤵
  PID:8184
- C:\Windows\System\LpooASE.exe
  C:\Windows\System\LpooASE.exe
  2⤵
  PID:7176
- C:\Windows\System\WjtTeUL.exe
  C:\Windows\System\WjtTeUL.exe
  2⤵
  PID:7240
- C:\Windows\System\txrBSsA.exe
  C:\Windows\System\txrBSsA.exe
  2⤵
  PID:7244
- C:\Windows\System\gIEPFPm.exe
  C:\Windows\System\gIEPFPm.exe
  2⤵
  PID:7336
- C:\Windows\System\ZIVQQqK.exe
  C:\Windows\System\ZIVQQqK.exe
  2⤵
  PID:7320
- C:\Windows\System\JDymSJL.exe
  C:\Windows\System\JDymSJL.exe
  2⤵
  PID:7324
- C:\Windows\System\NbxahtE.exe
  C:\Windows\System\NbxahtE.exe
  2⤵
  PID:7404
- C:\Windows\System\jniqIXx.exe
  C:\Windows\System\jniqIXx.exe
  2⤵
  PID:7288
- C:\Windows\System\AQvUgys.exe
  C:\Windows\System\AQvUgys.exe
  2⤵
  PID:7356
- C:\Windows\System\udRidAt.exe
  C:\Windows\System\udRidAt.exe
  2⤵
  PID:7472
- C:\Windows\System\QYxaHAK.exe
  C:\Windows\System\QYxaHAK.exe
  2⤵
  PID:7424
- C:\Windows\System\NMyHJGw.exe
  C:\Windows\System\NMyHJGw.exe
  2⤵
  PID:7568
- C:\Windows\System\bniLBER.exe
  C:\Windows\System\bniLBER.exe
  2⤵
  PID:7892
- C:\Windows\System\usaSSQQ.exe
  C:\Windows\System\usaSSQQ.exe
  2⤵
  PID:7744
- C:\Windows\System\tiUYMaH.exe
  C:\Windows\System\tiUYMaH.exe
  2⤵
  PID:7584
- C:\Windows\System\ptwQHvJ.exe
  C:\Windows\System\ptwQHvJ.exe
  2⤵
  PID:7840
- C:\Windows\System\mwLWRmk.exe
  C:\Windows\System\mwLWRmk.exe
  2⤵
  PID:7908
- C:\Windows\System\qfDqUjr.exe
  C:\Windows\System\qfDqUjr.exe
  2⤵
  PID:7780
- C:\Windows\System\zQYZrkh.exe
  C:\Windows\System\zQYZrkh.exe
  2⤵
  PID:7956
- C:\Windows\System\PNzAJLL.exe
  C:\Windows\System\PNzAJLL.exe
  2⤵
  PID:7968
- C:\Windows\System\treDVjt.exe
  C:\Windows\System\treDVjt.exe
  2⤵
  PID:8004
- C:\Windows\System\DrUIsgc.exe
  C:\Windows\System\DrUIsgc.exe
  2⤵
  PID:8080
- C:\Windows\System\VJtPlmX.exe
  C:\Windows\System\VJtPlmX.exe
  2⤵
  PID:8112
- C:\Windows\System\WMCuTra.exe
  C:\Windows\System\WMCuTra.exe
  2⤵
  PID:8176
- C:\Windows\System\sqnNhPh.exe
  C:\Windows\System\sqnNhPh.exe
  2⤵
  PID:6156
- C:\Windows\System\ztTGILB.exe
  C:\Windows\System\ztTGILB.exe
  2⤵
  PID:6952
- C:\Windows\System\fWGIDXn.exe
  C:\Windows\System\fWGIDXn.exe
  2⤵
  PID:7368
- C:\Windows\System\heTwavU.exe
  C:\Windows\System\heTwavU.exe
  2⤵
  PID:7352
- C:\Windows\System\fFYKqjn.exe
  C:\Windows\System\fFYKqjn.exe
  2⤵
  PID:7540
- C:\Windows\System\eNhhUga.exe
  C:\Windows\System\eNhhUga.exe
  2⤵
  PID:7192
- C:\Windows\System\yOPyfOx.exe
  C:\Windows\System\yOPyfOx.exe
  2⤵
  PID:7420
- C:\Windows\System\aTLUvoS.exe
  C:\Windows\System\aTLUvoS.exe
  2⤵
  PID:7456
- C:\Windows\System\OSQJyGa.exe
  C:\Windows\System\OSQJyGa.exe
  2⤵
  PID:7600
- C:\Windows\System\brLebXM.exe
  C:\Windows\System\brLebXM.exe
  2⤵
  PID:7604
- C:\Windows\System\ZrgTaBe.exe
  C:\Windows\System\ZrgTaBe.exe
  2⤵
  PID:7696
- C:\Windows\System\AgRntQs.exe
  C:\Windows\System\AgRntQs.exe
  2⤵
  PID:7760
- C:\Windows\System\BalQVSw.exe
  C:\Windows\System\BalQVSw.exe
  2⤵
  PID:7824
- C:\Windows\System\VdSMpNN.exe
  C:\Windows\System\VdSMpNN.exe
  2⤵
  PID:7856
- C:\Windows\System\xCbBCMD.exe
  C:\Windows\System\xCbBCMD.exe
  2⤵
  PID:7924
- C:\Windows\System\vzaXzOE.exe
  C:\Windows\System\vzaXzOE.exe
  2⤵
  PID:7716
- C:\Windows\System\XpuHYTP.exe
  C:\Windows\System\XpuHYTP.exe
  2⤵
  PID:8100
- C:\Windows\System\EHOPymk.exe
  C:\Windows\System\EHOPymk.exe
  2⤵
  PID:7208
- C:\Windows\System\XCsprsC.exe
  C:\Windows\System\XCsprsC.exe
  2⤵
  PID:8036
- C:\Windows\System\vnRzKXV.exe
  C:\Windows\System\vnRzKXV.exe
  2⤵
  PID:7732
- C:\Windows\System\mMUoYTy.exe
  C:\Windows\System\mMUoYTy.exe
  2⤵
  PID:7764
- C:\Windows\System\YSPhBYp.exe
  C:\Windows\System\YSPhBYp.exe
  2⤵
  PID:7616
- C:\Windows\System\aqUVeDx.exe
  C:\Windows\System\aqUVeDx.exe
  2⤵
  PID:8068
- C:\Windows\System\hMfFXIG.exe
  C:\Windows\System\hMfFXIG.exe
  2⤵
  PID:8164
- C:\Windows\System\TuxykIp.exe
  C:\Windows\System\TuxykIp.exe
  2⤵
  PID:7620
- C:\Windows\System\rBexXnl.exe
  C:\Windows\System\rBexXnl.exe
  2⤵
  PID:7952
- C:\Windows\System\YKMpiXu.exe
  C:\Windows\System\YKMpiXu.exe
  2⤵
  PID:8020
- C:\Windows\System\XlSlofk.exe
  C:\Windows\System\XlSlofk.exe
  2⤵
  PID:8052
- C:\Windows\System\xDfeNDl.exe
  C:\Windows\System\xDfeNDl.exe
  2⤵
  PID:8128
- C:\Windows\System\yXvmVwN.exe
  C:\Windows\System\yXvmVwN.exe
  2⤵
  PID:7228
- C:\Windows\System\jTKbLOO.exe
  C:\Windows\System\jTKbLOO.exe
  2⤵
  PID:7488
- C:\Windows\System\fqOXFVH.exe
  C:\Windows\System\fqOXFVH.exe
  2⤵
  PID:7664
- C:\Windows\System\rSYHAYR.exe
  C:\Windows\System\rSYHAYR.exe
  2⤵
  PID:8148
- C:\Windows\System\iJpeFxn.exe
  C:\Windows\System\iJpeFxn.exe
  2⤵
  PID:8048
- C:\Windows\System\msIIiEd.exe
  C:\Windows\System\msIIiEd.exe
  2⤵
  PID:7440
- C:\Windows\System\NogAVNB.exe
  C:\Windows\System\NogAVNB.exe
  2⤵
  PID:7940
- C:\Windows\System\qhnfJZW.exe
  C:\Windows\System\qhnfJZW.exe
  2⤵
  PID:7792
- C:\Windows\System\zTAuNNX.exe
  C:\Windows\System\zTAuNNX.exe
  2⤵
  PID:7392
- C:\Windows\System\TSQjkql.exe
  C:\Windows\System\TSQjkql.exe
  2⤵
  PID:7888
- C:\Windows\System\xLQpaFv.exe
  C:\Windows\System\xLQpaFv.exe
  2⤵
  PID:8160
- C:\Windows\System\QgqnuiY.exe
  C:\Windows\System\QgqnuiY.exe
  2⤵
  PID:8208
- C:\Windows\System\SrdbzCf.exe
  C:\Windows\System\SrdbzCf.exe
  2⤵
  PID:8224
- C:\Windows\System\iytnNfl.exe
  C:\Windows\System\iytnNfl.exe
  2⤵
  PID:8240
- C:\Windows\System\bqbKWfi.exe
  C:\Windows\System\bqbKWfi.exe
  2⤵
  PID:8256
- C:\Windows\System\WCnRIBe.exe
  C:\Windows\System\WCnRIBe.exe
  2⤵
  PID:8272
- C:\Windows\System\qVntooF.exe
  C:\Windows\System\qVntooF.exe
  2⤵
  PID:8288
- C:\Windows\System\SsbFDar.exe
  C:\Windows\System\SsbFDar.exe
  2⤵
  PID:8304
- C:\Windows\System\lzHZPdn.exe
  C:\Windows\System\lzHZPdn.exe
  2⤵
  PID:8320
- C:\Windows\System\lxRPhpy.exe
  C:\Windows\System\lxRPhpy.exe
  2⤵
  PID:8336
- C:\Windows\System\bYFQdMB.exe
  C:\Windows\System\bYFQdMB.exe
  2⤵
  PID:8352
- C:\Windows\System\LsWgzcm.exe
  C:\Windows\System\LsWgzcm.exe
  2⤵
  PID:8368
- C:\Windows\System\ydjbjrX.exe
  C:\Windows\System\ydjbjrX.exe
  2⤵
  PID:8384
- C:\Windows\System\UrAoNiC.exe
  C:\Windows\System\UrAoNiC.exe
  2⤵
  PID:8400
- C:\Windows\System\fjQWnjo.exe
  C:\Windows\System\fjQWnjo.exe
  2⤵
  PID:8416
- C:\Windows\System\gLsDIBw.exe
  C:\Windows\System\gLsDIBw.exe
  2⤵
  PID:8452
- C:\Windows\System\UgPLyjP.exe
  C:\Windows\System\UgPLyjP.exe
  2⤵
  PID:8532
- C:\Windows\System\lrSFYCc.exe
  C:\Windows\System\lrSFYCc.exe
  2⤵
  PID:8548
- C:\Windows\System\XqOXLin.exe
  C:\Windows\System\XqOXLin.exe
  2⤵
  PID:8564
- C:\Windows\System\zIZfaeY.exe
  C:\Windows\System\zIZfaeY.exe
  2⤵
  PID:8580
- C:\Windows\System\lCwfsXE.exe
  C:\Windows\System\lCwfsXE.exe
  2⤵
  PID:8596
- C:\Windows\System\gQFESYx.exe
  C:\Windows\System\gQFESYx.exe
  2⤵
  PID:8612
- C:\Windows\System\JTzKhNb.exe
  C:\Windows\System\JTzKhNb.exe
  2⤵
  PID:8628
- C:\Windows\System\vmnkajY.exe
  C:\Windows\System\vmnkajY.exe
  2⤵
  PID:8644
- C:\Windows\System\wthTbqV.exe
  C:\Windows\System\wthTbqV.exe
  2⤵
  PID:8668
- C:\Windows\System\LZllOKi.exe
  C:\Windows\System\LZllOKi.exe
  2⤵
  PID:8684
- C:\Windows\System\jqEMbpB.exe
  C:\Windows\System\jqEMbpB.exe
  2⤵
  PID:8700
- C:\Windows\System\tCwjHTf.exe
  C:\Windows\System\tCwjHTf.exe
  2⤵
  PID:8716
- C:\Windows\System\krHWwJx.exe
  C:\Windows\System\krHWwJx.exe
  2⤵
  PID:8732
- C:\Windows\System\aZGuTDv.exe
  C:\Windows\System\aZGuTDv.exe
  2⤵
  PID:8748
- C:\Windows\System\eZUsoTX.exe
  C:\Windows\System\eZUsoTX.exe
  2⤵
  PID:8764
- C:\Windows\System\fQPALQm.exe
  C:\Windows\System\fQPALQm.exe
  2⤵
  PID:8780
- C:\Windows\System\OrJmNVO.exe
  C:\Windows\System\OrJmNVO.exe
  2⤵
  PID:8816
- C:\Windows\System\GfZbFUj.exe
  C:\Windows\System\GfZbFUj.exe
  2⤵
  PID:8832
- C:\Windows\System\SfLeLvn.exe
  C:\Windows\System\SfLeLvn.exe
  2⤵
  PID:8848
- C:\Windows\System\MrkDzkx.exe
  C:\Windows\System\MrkDzkx.exe
  2⤵
  PID:8928
- C:\Windows\System\ZOqgVFw.exe
  C:\Windows\System\ZOqgVFw.exe
  2⤵
  PID:8944
- C:\Windows\System\iOXnOku.exe
  C:\Windows\System\iOXnOku.exe
  2⤵
  PID:8960
- C:\Windows\System\qsPXITI.exe
  C:\Windows\System\qsPXITI.exe
  2⤵
  PID:8976
- C:\Windows\System\vJWSSAv.exe
  C:\Windows\System\vJWSSAv.exe
  2⤵
  PID:8992
- C:\Windows\System\bqVcMwV.exe
  C:\Windows\System\bqVcMwV.exe
  2⤵
  PID:9008
- C:\Windows\System\pBOxkPd.exe
  C:\Windows\System\pBOxkPd.exe
  2⤵
  PID:9024
- C:\Windows\System\mArqYKr.exe
  C:\Windows\System\mArqYKr.exe
  2⤵
  PID:9044
- C:\Windows\System\OscSbqo.exe
  C:\Windows\System\OscSbqo.exe
  2⤵
  PID:9060
- C:\Windows\System\RaDkfse.exe
  C:\Windows\System\RaDkfse.exe
  2⤵
  PID:9076
- C:\Windows\System\lgZUATP.exe
  C:\Windows\System\lgZUATP.exe
  2⤵
  PID:9092
- C:\Windows\System\ORnnJLA.exe
  C:\Windows\System\ORnnJLA.exe
  2⤵
  PID:9108
- C:\Windows\System\bwXHNUq.exe
  C:\Windows\System\bwXHNUq.exe
  2⤵
  PID:9124
- C:\Windows\System\kUKjreV.exe
  C:\Windows\System\kUKjreV.exe
  2⤵
  PID:9140
- C:\Windows\System\uPPIQTx.exe
  C:\Windows\System\uPPIQTx.exe
  2⤵
  PID:9160
- C:\Windows\System\zVLZarm.exe
  C:\Windows\System\zVLZarm.exe
  2⤵
  PID:9180
- C:\Windows\System\dFTFnxY.exe
  C:\Windows\System\dFTFnxY.exe
  2⤵
  PID:9196
- C:\Windows\System\FiyqPrB.exe
  C:\Windows\System\FiyqPrB.exe
  2⤵
  PID:9212
- C:\Windows\System\JuLMYHP.exe
  C:\Windows\System\JuLMYHP.exe
  2⤵
  PID:8216
- C:\Windows\System\LQqkbUl.exe
  C:\Windows\System\LQqkbUl.exe
  2⤵
  PID:8280
- C:\Windows\System\FmhImml.exe
  C:\Windows\System\FmhImml.exe
  2⤵
  PID:8344
- C:\Windows\System\CxTSFhY.exe
  C:\Windows\System\CxTSFhY.exe
  2⤵
  PID:8408
- C:\Windows\System\TVddEyB.exe
  C:\Windows\System\TVddEyB.exe
  2⤵
  PID:8468
- C:\Windows\System\WsgkFDq.exe
  C:\Windows\System\WsgkFDq.exe
  2⤵
  PID:8484
- C:\Windows\System\IVhXHTO.exe
  C:\Windows\System\IVhXHTO.exe
  2⤵
  PID:8500
- C:\Windows\System\NXBipbo.exe
  C:\Windows\System\NXBipbo.exe
  2⤵
  PID:8516
- C:\Windows\System\TutaVuH.exe
  C:\Windows\System\TutaVuH.exe
  2⤵
  PID:8464
- C:\Windows\System\BPerLde.exe
  C:\Windows\System\BPerLde.exe
  2⤵
  PID:8592
- C:\Windows\System\WVooIke.exe
  C:\Windows\System\WVooIke.exe
  2⤵
  PID:8664
- C:\Windows\System\htfKhEv.exe
  C:\Windows\System\htfKhEv.exe
  2⤵
  PID:8692
- C:\Windows\System\wLzkCve.exe
  C:\Windows\System\wLzkCve.exe
  2⤵
  PID:8760
- C:\Windows\System\cEYObHW.exe
  C:\Windows\System\cEYObHW.exe
  2⤵
  PID:8800
- C:\Windows\System\HWitxHP.exe
  C:\Windows\System\HWitxHP.exe
  2⤵
  PID:7212
- C:\Windows\System\nkDyiKi.exe
  C:\Windows\System\nkDyiKi.exe
  2⤵
  PID:8200
- C:\Windows\System\bRikHey.exe
  C:\Windows\System\bRikHey.exe
  2⤵
  PID:8808
- C:\Windows\System\XGXEgsd.exe
  C:\Windows\System\XGXEgsd.exe
  2⤵
  PID:8608
- C:\Windows\System\wJAzkll.exe
  C:\Windows\System\wJAzkll.exe
  2⤵
  PID:8440
- C:\Windows\System\OxInOzX.exe
  C:\Windows\System\OxInOzX.exe
  2⤵
  PID:8360
- C:\Windows\System\swAPDNW.exe
  C:\Windows\System\swAPDNW.exe
  2⤵
  PID:8436
- C:\Windows\System\xTrkhXF.exe
  C:\Windows\System\xTrkhXF.exe
  2⤵
  PID:8888
- C:\Windows\System\eWudbIU.exe
  C:\Windows\System\eWudbIU.exe
  2⤵
  PID:8900
- C:\Windows\System\puBNVvK.exe
  C:\Windows\System\puBNVvK.exe
  2⤵
  PID:8916
- C:\Windows\System\ynjPoDQ.exe
  C:\Windows\System\ynjPoDQ.exe
  2⤵
  PID:8940
- C:\Windows\System\jpVTNmu.exe
  C:\Windows\System\jpVTNmu.exe
  2⤵
  PID:8972
- C:\Windows\System\QVyYnoq.exe
  C:\Windows\System\QVyYnoq.exe
  2⤵
  PID:9016
- C:\Windows\System\PdbxnSL.exe
  C:\Windows\System\PdbxnSL.exe
  2⤵
  PID:9072
- C:\Windows\System\oBhclnS.exe
  C:\Windows\System\oBhclnS.exe
  2⤵
  PID:9084
- C:\Windows\System\plLiqSs.exe
  C:\Windows\System\plLiqSs.exe
  2⤵
  PID:9136
- C:\Windows\System\iqTkyox.exe
  C:\Windows\System\iqTkyox.exe
  2⤵
  PID:9148
- C:\Windows\System\JbHryhI.exe
  C:\Windows\System\JbHryhI.exe
  2⤵
  PID:9176
- C:\Windows\System\EBGXTAJ.exe
  C:\Windows\System\EBGXTAJ.exe
  2⤵
  PID:9188
- C:\Windows\System\yCvIjPY.exe
  C:\Windows\System\yCvIjPY.exe
  2⤵
  PID:8348
- C:\Windows\System\KcLXvXF.exe
  C:\Windows\System\KcLXvXF.exe
  2⤵
  PID:8492
- C:\Windows\System\JzsTRiF.exe
  C:\Windows\System\JzsTRiF.exe
  2⤵
  PID:8460
- C:\Windows\System\gPbQVVV.exe
  C:\Windows\System\gPbQVVV.exe
  2⤵
  PID:8528
- C:\Windows\System\Encvsmd.exe
  C:\Windows\System\Encvsmd.exe
  2⤵
  PID:8560
- C:\Windows\System\ThNVRAZ.exe
  C:\Windows\System\ThNVRAZ.exe
  2⤵
  PID:8792
- C:\Windows\System\MlFBqSK.exe
  C:\Windows\System\MlFBqSK.exe
  2⤵
  PID:7196
- C:\Windows\System\CHvsTmc.exe
  C:\Windows\System\CHvsTmc.exe
  2⤵
  PID:8756
- C:\Windows\System\OAgnkkJ.exe
  C:\Windows\System\OAgnkkJ.exe
  2⤵
  PID:8428
- C:\Windows\System\Fwejycq.exe
  C:\Windows\System\Fwejycq.exe
  2⤵
  PID:8544
- C:\Windows\System\SGwHdjP.exe
  C:\Windows\System\SGwHdjP.exe
  2⤵
  PID:8448
- C:\Windows\System\WfzoFzC.exe
  C:\Windows\System\WfzoFzC.exe
  2⤵
  PID:8776
- C:\Windows\System\DkQzvtP.exe
  C:\Windows\System\DkQzvtP.exe
  2⤵
  PID:8744
- C:\Windows\System\buAqdrH.exe
  C:\Windows\System\buAqdrH.exe
  2⤵
  PID:8676
- C:\Windows\System\okaTYZg.exe
  C:\Windows\System\okaTYZg.exe
  2⤵
  PID:8824
- C:\Windows\System\UEYLzdE.exe
  C:\Windows\System\UEYLzdE.exe
  2⤵
  PID:8856
- C:\Windows\System\JyoJcpZ.exe
  C:\Windows\System\JyoJcpZ.exe
  2⤵
  PID:8884
- C:\Windows\System\VpEYxKw.exe
  C:\Windows\System\VpEYxKw.exe
  2⤵
  PID:7812
- C:\Windows\System\dXgEWXM.exe
  C:\Windows\System\dXgEWXM.exe
  2⤵
  PID:7572
- C:\Windows\System\mLnWAbU.exe
  C:\Windows\System\mLnWAbU.exe
  2⤵
  PID:9056
- C:\Windows\System\EdZvRDJ.exe
  C:\Windows\System\EdZvRDJ.exe
  2⤵
  PID:8396
- C:\Windows\System\kAIbgFH.exe
  C:\Windows\System\kAIbgFH.exe
  2⤵
  PID:7636
- C:\Windows\System\hGaXavj.exe
  C:\Windows\System\hGaXavj.exe
  2⤵
  PID:8032
- C:\Windows\System\qEEaKCV.exe
  C:\Windows\System\qEEaKCV.exe
  2⤵
  PID:8772
- C:\Windows\System\oWXCNft.exe
  C:\Windows\System\oWXCNft.exe
  2⤵
  PID:8860
- C:\Windows\System\ePUmsck.exe
  C:\Windows\System\ePUmsck.exe
  2⤵
  PID:8508
- C:\Windows\System\CqShhwe.exe
  C:\Windows\System\CqShhwe.exe
  2⤵
  PID:9032
- C:\Windows\System\MWKTZGE.exe
  C:\Windows\System\MWKTZGE.exe
  2⤵
  PID:9172
- C:\Windows\System\HwvPYFX.exe
  C:\Windows\System\HwvPYFX.exe
  2⤵
  PID:9036
- C:\Windows\System\FPTcaAE.exe
  C:\Windows\System\FPTcaAE.exe
  2⤵
  PID:7524
- C:\Windows\System\vwEddTy.exe
  C:\Windows\System\vwEddTy.exe
  2⤵
  PID:8640
- C:\Windows\System\ChiwfHd.exe
  C:\Windows\System\ChiwfHd.exe
  2⤵
  PID:8252
- C:\Windows\System\YEeVOYM.exe
  C:\Windows\System\YEeVOYM.exe
  2⤵
  PID:8952
- C:\Windows\System\NKiwtZs.exe
  C:\Windows\System\NKiwtZs.exe
  2⤵
  PID:9224
- C:\Windows\System\wPAElJk.exe
  C:\Windows\System\wPAElJk.exe
  2⤵
  PID:9296
- C:\Windows\System\mDJWhOb.exe
  C:\Windows\System\mDJWhOb.exe
  2⤵
  PID:9320
- C:\Windows\System\QfEMwbE.exe
  C:\Windows\System\QfEMwbE.exe
  2⤵
  PID:9336
- C:\Windows\System\ptDZCiF.exe
  C:\Windows\System\ptDZCiF.exe
  2⤵
  PID:9356
- C:\Windows\System\dXxecXr.exe
  C:\Windows\System\dXxecXr.exe
  2⤵
  PID:9372
- C:\Windows\System\KMQfwyv.exe
  C:\Windows\System\KMQfwyv.exe
  2⤵
  PID:9388
- C:\Windows\System\OYjHCKg.exe
  C:\Windows\System\OYjHCKg.exe
  2⤵
  PID:9404
- C:\Windows\System\DlpxraT.exe
  C:\Windows\System\DlpxraT.exe
  2⤵
  PID:9420
- C:\Windows\System\MJKzBFi.exe
  C:\Windows\System\MJKzBFi.exe
  2⤵
  PID:9436
- C:\Windows\System\zshKONT.exe
  C:\Windows\System\zshKONT.exe
  2⤵
  PID:9452
- C:\Windows\System\XtoeqDu.exe
  C:\Windows\System\XtoeqDu.exe
  2⤵
  PID:9468
- C:\Windows\System\jQMipPc.exe
  C:\Windows\System\jQMipPc.exe
  2⤵
  PID:9484
- C:\Windows\System\EzKrEXi.exe
  C:\Windows\System\EzKrEXi.exe
  2⤵
  PID:9500
- C:\Windows\System\hhghJvz.exe
  C:\Windows\System\hhghJvz.exe
  2⤵
  PID:9516
- C:\Windows\System\qWoTEJH.exe
  C:\Windows\System\qWoTEJH.exe
  2⤵
  PID:9532
- C:\Windows\System\yPupEnI.exe
  C:\Windows\System\yPupEnI.exe
  2⤵
  PID:9548
- C:\Windows\System\zuZmveR.exe
  C:\Windows\System\zuZmveR.exe
  2⤵
  PID:9564
- C:\Windows\System\jmiafyp.exe
  C:\Windows\System\jmiafyp.exe
  2⤵
  PID:9580
- C:\Windows\System\UTzygwG.exe
  C:\Windows\System\UTzygwG.exe
  2⤵
  PID:9596
- C:\Windows\System\gETqpON.exe
  C:\Windows\System\gETqpON.exe
  2⤵
  PID:9616
- C:\Windows\System\lxGFSSB.exe
  C:\Windows\System\lxGFSSB.exe
  2⤵
  PID:9632
- C:\Windows\System\lotgGnV.exe
  C:\Windows\System\lotgGnV.exe
  2⤵
  PID:9648
- C:\Windows\System\yZXjQuW.exe
  C:\Windows\System\yZXjQuW.exe
  2⤵
  PID:9664
- C:\Windows\System\JIeWVYU.exe
  C:\Windows\System\JIeWVYU.exe
  2⤵
  PID:9680
- C:\Windows\System\ldfXtLZ.exe
  C:\Windows\System\ldfXtLZ.exe
  2⤵
  PID:9696
- C:\Windows\System\mSvaaEO.exe
  C:\Windows\System\mSvaaEO.exe
  2⤵
  PID:9712
- C:\Windows\System\oKqDguJ.exe
  C:\Windows\System\oKqDguJ.exe
  2⤵
  PID:9728
- C:\Windows\System\APNlncU.exe
  C:\Windows\System\APNlncU.exe
  2⤵
  PID:9744
- C:\Windows\System\fdJJIet.exe
  C:\Windows\System\fdJJIet.exe
  2⤵
  PID:9760
- C:\Windows\System\iiWzfXB.exe
  C:\Windows\System\iiWzfXB.exe
  2⤵
  PID:9776
- C:\Windows\System\mrvlziw.exe
  C:\Windows\System\mrvlziw.exe
  2⤵
  PID:9792
- C:\Windows\System\SCBvTtS.exe
  C:\Windows\System\SCBvTtS.exe
  2⤵
  PID:9808
- C:\Windows\System\VJHrIeg.exe
  C:\Windows\System\VJHrIeg.exe
  2⤵
  PID:9832
- C:\Windows\System\hYmHUBm.exe
  C:\Windows\System\hYmHUBm.exe
  2⤵
  PID:9848
- C:\Windows\System\vNZkJCa.exe
  C:\Windows\System\vNZkJCa.exe
  2⤵
  PID:9864
- C:\Windows\System\nNzzohZ.exe
  C:\Windows\System\nNzzohZ.exe
  2⤵
  PID:9880
- C:\Windows\System\JLlaPVf.exe
  C:\Windows\System\JLlaPVf.exe
  2⤵
  PID:9896
- C:\Windows\System\EtFviHZ.exe
  C:\Windows\System\EtFviHZ.exe
  2⤵
  PID:9912
- C:\Windows\System\BJglSle.exe
  C:\Windows\System\BJglSle.exe
  2⤵
  PID:9928
- C:\Windows\System\hweXtar.exe
  C:\Windows\System\hweXtar.exe
  2⤵
  PID:9944
- C:\Windows\System\FznkWqP.exe
  C:\Windows\System\FznkWqP.exe
  2⤵
  PID:9960
- C:\Windows\System\kNNlKzU.exe
  C:\Windows\System\kNNlKzU.exe
  2⤵
  PID:9976
- C:\Windows\System\ApkGaCT.exe
  C:\Windows\System\ApkGaCT.exe
  2⤵
  PID:9992
- C:\Windows\System\ZETxJQG.exe
  C:\Windows\System\ZETxJQG.exe
  2⤵
  PID:10008
- C:\Windows\System\zEHTycA.exe
  C:\Windows\System\zEHTycA.exe
  2⤵
  PID:10024
- C:\Windows\System\LdvsiYm.exe
  C:\Windows\System\LdvsiYm.exe
  2⤵
  PID:10040
- C:\Windows\System\sPlQRwQ.exe
  C:\Windows\System\sPlQRwQ.exe
  2⤵
  PID:10056
- C:\Windows\System\IhbXGzp.exe
  C:\Windows\System\IhbXGzp.exe
  2⤵
  PID:10072
- C:\Windows\System\vwToFSJ.exe
  C:\Windows\System\vwToFSJ.exe
  2⤵
  PID:10088
- C:\Windows\System\TZjvuAR.exe
  C:\Windows\System\TZjvuAR.exe
  2⤵
  PID:10104
- C:\Windows\System\gnnxKYM.exe
  C:\Windows\System\gnnxKYM.exe
  2⤵
  PID:10128
- C:\Windows\System\ZCRQKdd.exe
  C:\Windows\System\ZCRQKdd.exe
  2⤵
  PID:10148
- C:\Windows\System\VzgntNI.exe
  C:\Windows\System\VzgntNI.exe
  2⤵
  PID:10164
- C:\Windows\System\UKpiIKG.exe
  C:\Windows\System\UKpiIKG.exe
  2⤵
  PID:10180
- C:\Windows\System\MmzXXjc.exe
  C:\Windows\System\MmzXXjc.exe
  2⤵
  PID:10196
- C:\Windows\System\SubvteO.exe
  C:\Windows\System\SubvteO.exe
  2⤵
  PID:10212
- C:\Windows\System\cMaPfjV.exe
  C:\Windows\System\cMaPfjV.exe
  2⤵
  PID:10228
- C:\Windows\System\CIZNDud.exe
  C:\Windows\System\CIZNDud.exe
  2⤵
  PID:8724
- C:\Windows\System\lZJeqyn.exe
  C:\Windows\System\lZJeqyn.exe
  2⤵
  PID:9220
- C:\Windows\System\tDbTNLW.exe
  C:\Windows\System\tDbTNLW.exe
  2⤵
  PID:9000
- C:\Windows\System\nrMeCpf.exe
  C:\Windows\System\nrMeCpf.exe
  2⤵
  PID:8264
- C:\Windows\System\cVSdsto.exe
  C:\Windows\System\cVSdsto.exe
  2⤵
  PID:9104
- C:\Windows\System\LqLqqtw.exe
  C:\Windows\System\LqLqqtw.exe
  2⤵
  PID:8708
- C:\Windows\System\aTNJOvr.exe
  C:\Windows\System\aTNJOvr.exe
  2⤵
  PID:8680
- C:\Windows\System\istuHVF.exe
  C:\Windows\System\istuHVF.exe
  2⤵
  PID:7520
- C:\Windows\System\YXyHzmr.exe
  C:\Windows\System\YXyHzmr.exe
  2⤵
  PID:9260
- C:\Windows\System\jgrGaOv.exe
  C:\Windows\System\jgrGaOv.exe
  2⤵
  PID:9272
- C:\Windows\System\lnkyxei.exe
  C:\Windows\System\lnkyxei.exe
  2⤵
  PID:9288
- C:\Windows\System\HAaYeiX.exe
  C:\Windows\System\HAaYeiX.exe
  2⤵
  PID:9368
- C:\Windows\System\myJIfBs.exe
  C:\Windows\System\myJIfBs.exe
  2⤵
  PID:9428
- C:\Windows\System\uphTGjX.exe
  C:\Windows\System\uphTGjX.exe
  2⤵
  PID:9492
- C:\Windows\System\ZRBhleo.exe
  C:\Windows\System\ZRBhleo.exe
  2⤵
  PID:9556
- C:\Windows\System\XodYPWL.exe
  C:\Windows\System\XodYPWL.exe
  2⤵
  PID:9656
- C:\Windows\System\FHTTzHh.exe
  C:\Windows\System\FHTTzHh.exe
  2⤵
  PID:9308
- C:\Windows\System\bazMxie.exe
  C:\Windows\System\bazMxie.exe
  2⤵
  PID:9444
- C:\Windows\System\XtGfPzC.exe
  C:\Windows\System\XtGfPzC.exe
  2⤵
  PID:9856
- C:\Windows\System\OGWnOHW.exe
  C:\Windows\System\OGWnOHW.exe
  2⤵
  PID:9952
- C:\Windows\System\xRIoqhf.exe
  C:\Windows\System\xRIoqhf.exe
  2⤵
  PID:9988
- C:\Windows\System\wEmRBCn.exe
  C:\Windows\System\wEmRBCn.exe
  2⤵
  PID:10080
- C:\Windows\System\CWbSnbA.exe
  C:\Windows\System\CWbSnbA.exe
  2⤵
  PID:10120
- C:\Windows\System\CBebBKR.exe
  C:\Windows\System\CBebBKR.exe
  2⤵
  PID:10116
- C:\Windows\System\pjVtXbm.exe
  C:\Windows\System\pjVtXbm.exe
  2⤵
  PID:9972
- C:\Windows\System\gzFZSrr.exe
  C:\Windows\System\gzFZSrr.exe
  2⤵
  PID:9936
- C:\Windows\System\ZYbeAok.exe
  C:\Windows\System\ZYbeAok.exe
  2⤵
  PID:10004
- C:\Windows\System\BQViqMt.exe
  C:\Windows\System\BQViqMt.exe
  2⤵
  PID:10068
- C:\Windows\System\xJNzcxv.exe
  C:\Windows\System\xJNzcxv.exe
  2⤵
  PID:10160
- C:\Windows\System\UZJjhaQ.exe
  C:\Windows\System\UZJjhaQ.exe
  2⤵
  PID:10224
- C:\Windows\System\IUQOGoe.exe
  C:\Windows\System\IUQOGoe.exe
  2⤵
  PID:9208
- C:\Windows\System\OfTVLwV.exe
  C:\Windows\System\OfTVLwV.exe
  2⤵
  PID:8524
- C:\Windows\System\HpKcVyU.exe
  C:\Windows\System\HpKcVyU.exe
  2⤵
  PID:9328
- C:\Windows\System\lOLhhYC.exe
  C:\Windows\System\lOLhhYC.exe
  2⤵
  PID:10144
- C:\Windows\System\FafWZHt.exe
  C:\Windows\System\FafWZHt.exe
  2⤵
  PID:10204
- C:\Windows\System\tIQxBxP.exe
  C:\Windows\System\tIQxBxP.exe
  2⤵
  PID:9708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BbKcIFZ.exe

Filesize
2.1MB

MD5
790849ad9818773512e213322bc0eb21

SHA1
ca5ce3b52180422d4bb1411c55f4efc35e495625

SHA256
7ce274df0fdcbb083953b1cb0f844e3305fcd8f6c1b629cc8b836d842104c58f

SHA512
dff4d28bbabac46b584c7e63ff8acb728d7e5becb7d4e389c862ac8fefc019d56609689e781023a569bd50d376cd21f411a158ca2dbaa349c0c564bb1c59f25d

Download Submit
C:\Windows\system\DLkCoad.exe

Filesize
2.1MB

MD5
d51c05283e84029984eb4351b86a3b6c

SHA1
9429c0422ee95844fe2a7eedfa3bded6c1e0e6c3

SHA256
526d7b875dd71d7485425670ba435561985052a985cc7e0928294a7ae1efc599

SHA512
7ac64c3959e0965be2528d021ab4efb249b7816042ba663218c8eee3517afd766bed23e8e828f2451bb113b09b17a50e23c37d6c849a279d2c70972a64eb3dc1

Download Submit
C:\Windows\system\DUfmsbR.exe

Filesize
2.1MB

MD5
584ffc6ca617057d36fbd5089b340497

SHA1
2382e93f4a484c973f6fafa4116bbaf5548528eb

SHA256
e5e83e9bf9235cbd375f01c5b6ebd37f308c62f0dc2b506c36073b107722244d

SHA512
a2fe8a52ddb538507b8fe004efd3c90f729166e8bb8815e3b9a50095ce6f9455305e2352f767172ab3fd7283d080613b2c6320bfe865684dcf06d2fa72470bd9

Download Submit
C:\Windows\system\EkqPaGC.exe

Filesize
2.1MB

MD5
043a88052d6a2bf3bda89be63d1a3dd8

SHA1
a92cd5ca76a0a90a9d6d2ea7673505806de0ee0c

SHA256
bde5b0740de9cd395f93765c2f0068b26e953040f126f2b3e7be685c57e5f6a3

SHA512
bf5e7aa72ee2712106d1e0d6efb38667beb53e116fd495dbfec0013550952dfee2dff80fdc89911f79a651a7fe972375e9d8419b91ad1edd1e7e8e2683633163

Download Submit
C:\Windows\system\FohQaIo.exe

Filesize
2.1MB

MD5
198cbb17bdfa2333620a1d6737a092c2

SHA1
c4334b683358a0bd49f95b59db680d7da2f81eb7

SHA256
542936a6d68177f640abecc47db56966d33ab0cfece1c51b0c1a77784ac86905

SHA512
0f6cbaf19c7e606047ebe3ecf7cd214635f2f6a6887f6bdf1a84c5b9cd8b4b989b6d62383505fd836d3d84172e055af5f60d55cf55fdd0c879050d3d4bf51269

Download Submit
C:\Windows\system\JfWlAUz.exe

Filesize
2.1MB

MD5
5b4e1af0833b8fae44d0f71c155ad97c

SHA1
6aa0f11aff39909e0ac30175c7187aae5d097882

SHA256
6f20287360346f4ef3c00c6da66dadcfa2dc64efd33d2c374bbd2dc1b9efb857

SHA512
4cc95ebb920ff315d49ecba8a7831bdf38d50af987e13b805e44e5edb705d0878c9b755eeb3e4b2c65d8d8855e7bb22eaadfabc2c0a1b78f8e6caccc121107b0

Download Submit
C:\Windows\system\LZCIwzD.exe

Filesize
2.1MB

MD5
79359bc862b4d526c4d4880bff97547b

SHA1
1ef86bc66ec4812ffab5462060f5c059d85aed46

SHA256
7e6dc0be50e79dab8debc22dc572d4624105249142d3918fd4b4f824b00631ea

SHA512
5195b9fce903111c3f50e251ec14f04724266e99ade393be3c78cb2232659ca58d136367f638f21720d9681eba123449e5926ecd8f7a785cffd3d08173320ac3

Download Submit
C:\Windows\system\NTOqsXs.exe

Filesize
2.1MB

MD5
24a927c4093152c3e4d10e7f1c2484a1

SHA1
0ae095b564d1c6d1d692353a70168af36840277c

SHA256
690ddacb577640633f035a5f1d899764d9e1a7e233abaaf8e4882cc322ee8abb

SHA512
eb6550653dc9c6d07366aa4797630b3dbfb4025ee6c074fa391e11d5d6da160114597524c19397a05f896359de3b1a7623a4bbff903e6881a35cee7a0cb2dd10

Download Submit
C:\Windows\system\PCVHpQH.exe

Filesize
2.1MB

MD5
ccb5a81a931c265337547ef15c7136fd

SHA1
a656f52218f461636ba45afef3ea007582a8f82b

SHA256
672078d172663d4ee251267afea10bf831942d6850f4caa5122b0b47d7bcf117

SHA512
7eb596fb347e2de7f076071fea0f6cbdcd52a7e767c32050c8acb25d88c19e8e6875b49d557bd88ca9e5a0d1f0cc62cad5d73e88b1437acaf0aef56c1ef7649c

Download Submit
C:\Windows\system\SDWjzkE.exe

Filesize
2.1MB

MD5
7adfad76df704088f59a4011fef9a96e

SHA1
4c566fb5ff3308665cb4b9d8bce81f0b0213165d

SHA256
548e613972b3320f7390e92697bbe2fb1456ba0b03932df5d012597a22dfe8f1

SHA512
f6fa45f7f5f25e1cf0fd8a82fc630ac351895f25312b195b02094cb6892441a61a5933890cf94171bcfbf02f82c82651544513a0c0b57b84c041793c7dda65b3

Download Submit
C:\Windows\system\SKchegs.exe

Filesize
2.1MB

MD5
17488154dff9ef62ad98c0ba5831b4b6

SHA1
0414c7e00c8ae4c66c353be240542fd030428856

SHA256
f7a749434908c4e79de5277d5d17bf4e152fd9cf466e5f13923866d592557b3c

SHA512
872d24bf68f9a06b698829dca7886e69894350aab0a6175a836a1f8d781ff4db20157971c599bd3056e04c773e3b3d262481386260ea5603b010f355856372c7

Download Submit
C:\Windows\system\ZXqfpXB.exe

Filesize
2.1MB

MD5
d93f59604dd42ab256af4ac3e3ca99ce

SHA1
011a10f36e77f14c22e841e00272ac6bb3721172

SHA256
7d982f1d115c66325a6d90628f422f2dc3d33ea5b1bf7b204fd11bfb38013fa5

SHA512
061537bfc0a8a9c402a54e6d256c263be4b07a224b96f653a6003ce304397de1bbeaa6a234ae79fc92e8fb40d6776ed40ed7d983e4ec10a204f9f472efede8ea

Download Submit
C:\Windows\system\bGQcIau.exe

Filesize
2.1MB

MD5
f6fe0db4863997a06c0c8611f6788008

SHA1
ab26f2ae99a88940f5442ab7f92f31cbefbb79c3

SHA256
413c306689fb4777e9fc82f144116dd30c20f391be58a5e7ad26573333060438

SHA512
3b6e14b3c728fdd434ff83d29b833a7231ac140117afd98e526c79b930d359d506e5ab5c32b72e3be9232b962ca1e3da01742fbf971525deb4db50498cfec9c2

Download Submit
C:\Windows\system\eOduqYf.exe

Filesize
2.1MB

MD5
fd6318106f1e26e355b1242eb3505aea

SHA1
9a5f2646c410aa006ae4e96a0ce6fc22892f7a62

SHA256
8ec29c596bf7ab8818de0b3d8857fb06409ed0a76a8010a841c9c5d3e52047a0

SHA512
23663f9526d6ad2be57ea3b2f6976d81ca819b5b5f512446aeb9ff55c4ba1188c990a61e5125dc4fe844e3f68387b2fcac790fd5b10fe469131e080487cbe6c9

Download Submit
C:\Windows\system\eZQNDbw.exe

Filesize
2.1MB

MD5
c5aa16cae01efd08b72942d92fdea976

SHA1
0ceb6cd2d2033a8b1015fd0ce977ed7416fe48ce

SHA256
61f5ca930d5f1eff11a52588937c26b7ffeed6767132ef858017eb7967d9d54b

SHA512
2dc1b8a7695b853dd8bb512add5ea0fb164a63aa6a3fe8276ff3b3de3faf8db4c36f0be978f2afccbd87087bdc5b5ed091b8f81334e3c455f78913389dab46c7

Download Submit
C:\Windows\system\gGiSngE.exe

Filesize
18B

MD5
d5bd41f01d061c01f52e6978430753cd

SHA1
cb4df42e6340c52d7481be60e7fe760406534e0f

SHA256
5c867963137a5794ab3337f35a270d84933a4b4dbbc2135e1c7877d73a31dc4d

SHA512
29b688745cb47dbf4f714b34013c3ae03435424ee7da633ad45650db85c1117e2dcc8f47c132da11cc01922825ccbb6fc0828fd2f3eab8b4fbf45bbf1deb62bd

Download Submit
C:\Windows\system\giAcBBz.exe

Filesize
2.1MB

MD5
56fb7b7ac1aab8a44cff47d2839aa79c

SHA1
ff5261632c3542b598b6d13bf61e3364e6b0c847

SHA256
308d210fe152f27cfbe3b17212ee2a8093ee0ac3a577bf2a9f0c17bfb2bf5a0a

SHA512
0020bece873fb28f2981dc2d3967bc6e8773d5f50032a745cd9138508deee0030db2020d971e22c557677c96edc1f8272256e114267fe78470112284b48537d5

Download Submit
C:\Windows\system\pxaEQzy.exe

Filesize
2.1MB

MD5
ed26aeb639dfae4cba6bbed8dab16830

SHA1
d846e207842c467c2cfe9b1dfc94ed0ca680068c

SHA256
93494841e0ff5a8dc36083cb725e310b9867f1a24ded79929f360de99367de4d

SHA512
d1783fdbe063baf2da5150be2e8f84112ee06a4f9eae43c2a30f1743f071f7b2aae07fe949dabed5c0963db7c569dd167d3285fcba33019ade08b255c2ccbe73

Download Submit
C:\Windows\system\rWTvFnV.exe

Filesize
2.1MB

MD5
30886645f1a19cad3a2c8dee8a7f62f0

SHA1
485f6e740906b960adaaa966e0429766ee28e854

SHA256
9adfcb6525837ea1ab39617164f9da0e3b3491a9a4528dc3d621173a21636f51

SHA512
30fee14f10d75734d8d9a0f6ed2a76b26f5d3010e9a9ab227478cae738e70d6dfd602c871f01af1f28278f97ca377a87694d732725e47baf29b2b916b80d6f37

Download Submit
C:\Windows\system\sVemCEj.exe

Filesize
2.1MB

MD5
cefe50294d398991a550efdc514ad65d

SHA1
e1dde26d09b4c534829a06093c1a67c422beab5e

SHA256
9e050ce15ebee4dd33ee71ffccbda1c418a1cf79760c48e47d6775dd7ac025a7

SHA512
922ff2385d2d50817355136fec6422a76809accbe2248973d0aecf1d6fd498f2676fe5c5676be0d66f6888b22d442400e90b02a08f2989331b7b20a855bbfb37

Download Submit
C:\Windows\system\shVMxMP.exe

Filesize
2.1MB

MD5
44436f34179a8c77eb3366a65cd68fac

SHA1
b2526cd08afdd6714405cf66ea5f5cfcb3a4bfb7

SHA256
64467e16089e020971c53af3b637b04df66a554dbbd1c04dacd945d458d73141

SHA512
c73fee1e9dd248d4e30e383f76ca85021308dd557608c1127e9c23be77265de3b5bd5b36bf899f864b450041b09796f2dff3d2a2c22967aa40f84d3e537792c8

Download Submit
C:\Windows\system\ucZMjiE.exe

Filesize
2.1MB

MD5
d5c3bfc41a93316099320d17093a5ef5

SHA1
7a258d3ece578cb6a4c185f7352398baa15606af

SHA256
fdc971163e5e30687b0d14faaee81c67ba8a30ab3e5dfc46942952a56e6fd9d4

SHA512
333a432810ac5adb65f9ec69b7b16279e1deb96efc7f8feba6ce38e4c25cea2b16ac5fc7a674cb64e20d1dfc84546d5da9b689874c3eb4568016e81aa8938ab6

Download Submit
C:\Windows\system\vhTboYn.exe

Filesize
2.1MB

MD5
b6d7773bbcdadb2cb3e093c3bc51147d

SHA1
3c6d70d47acef91e3baad1746a55508eda067d67

SHA256
3d88fc18d71145c06f647c3dc6ce5789f8991cdfb9f67244fa21006fb2994f6d

SHA512
f72f058f41565c0bc2ec830ec8c5ed0fcf2ffdffa14df7eac55921315f44e4c30cda5e6754421ff13904db26570c71cdb1234b56b6c31f501d9bd73f15ae63f2

Download Submit
C:\Windows\system\xogiRDd.exe

Filesize
2.1MB

MD5
e156d34d6860032e930e847b306d4e11

SHA1
8cf0510bc951791e7e3992841653e287f05ef1f0

SHA256
c67a3983538a963e4a94d75feebea9031a83e65d9fbfce0977d76435086ae2e2

SHA512
1740cb772d135d75e6fbca6aab6101b68cc0e8421357185b45065e5508c0d6b0805a30ec8a136e2baaad537137213203ca029126e6a433cb68e3d281a6131cf7

Download Submit
C:\Windows\system\xrOjbhI.exe

Filesize
2.1MB

MD5
45967647efba5af997371953b77155bd

SHA1
7d3cde860afbded92dd1363f820929b2e191a41b

SHA256
9fd9c98dcf793479bae13b98b5c7855b779f56e5604352fc713bb1e661bfb013

SHA512
88964702fe1d8eea475818314034c1bf541b454bdf483b6d444530137d07a0a71d7224dffd129c231402607a2c5974067e1cfc399b6aeaec63a408a3c826bc67

Download Submit
C:\Windows\system\yTVhvil.exe

Filesize
2.1MB

MD5
d208c62f292a7b9576cd557433b89cf7

SHA1
b4aea4f8057a31ab1780407e079c066665a3be51

SHA256
4faa191e43fcc24f9f0715763b2a1c7f561cb693a87073f7378639853368f119

SHA512
bd0066d753d729f2fc90d83acc842a6ae9e715c539e4922d22dca9c7a9969e2bdfdb3dc77077469e6f04c2a2e4054a6de6b08db2dd5d427da93824d4874b539f

Download Submit
C:\Windows\system\zjjoFqE.exe

Filesize
2.1MB

MD5
6ee2a631ea6fb5b295e4a11bfb96c7f4

SHA1
a3784fe18994daf50d6ff514e78836b937c2bf37

SHA256
826b61570e30ce007575f17249422ce5a3a9b46b9534f2b950a0be12227988ec

SHA512
96bf0991ef905766ad81251ee4fadd50280bef5c9ef72daf19f73816981182f81a2231d901a269dd8780e15d50d15a90eb5e4b0fef19e21a8b50d1f386338199

Download Submit
\Windows\system\AptbJte.exe

Filesize
2.1MB

MD5
57aaaa91df906cd9b67da672899a91db

SHA1
f3266a10c730cab243d3400294abb268413bc539

SHA256
d396ae3b7279bfface618a35d6e411707f111a212b3ea7122bb3c0c99dc413ca

SHA512
106e81fc2ba91de806fc3343f4828332261124cf621f73477b24abaf088c09480b2714191b4cd70045c06ace5aa98e4f15baca7835b436517d88537b310023a8

Download Submit
\Windows\system\BGglnUt.exe

Filesize
2.1MB

MD5
bc678ae6c33c8e30093b3e77bcf88026

SHA1
02f80c13c800fa37960b7662b823807b396bd622

SHA256
5a7d439ef55c6e3f1ebf3ee8b2a07b31e547edb2b61f47e57aa61ad258b51ad2

SHA512
50db4b735552cb145a2d173b13929a59d88ff4b67bf7ae200c7a3e8c66d2e3fc4af4b3feb3a617ed13cee5b8ad46e6f716ad165bf7101df1a1622470c9b1a0b4

Download Submit
\Windows\system\KYdPPMX.exe

Filesize
2.1MB

MD5
9e1ac79fec0021cb009dd843d89225b0

SHA1
8c3122a0803d03c65d7de149d4a07c06554b8e4a

SHA256
6a0827410d9e868024fa15b2003da6720382897ccef11595990fe14555cd2ebe

SHA512
1808334304e0323334665941d9020775ed16e4ba15998127cef201aa0f0a81b52a3d241b29a72a06b24a03034c41153e4ca2e14e15ff44aee1de1f15413dfc59

Download Submit
\Windows\system\SgEdals.exe

Filesize
2.1MB

MD5
732cf4508b22825c6fa4923883fbfdb8

SHA1
12f966c54ed38d1c8e6eab6f4401e78c99bfa760

SHA256
3c4221324b7ec7f7e4dadcff6ec7f1a424e7c3b39364bb346250af49974b2770

SHA512
e8ba7f0867e96368bd8e4640576c05c6acac6983461f2d76a86dacda05a9001a631aba9dc005f12fcc9c9d65e53f8f1ea4d01f545ed261d2785f245175414fc2

Download Submit
\Windows\system\aLuUCmZ.exe

Filesize
2.1MB

MD5
9916603480563aa69cc902365a2cce43

SHA1
582892d6639e701b490a9dd626523ce4e495d0ad

SHA256
83b460c3325c0cf0384861a473649949d5a7b38a60679d7a8c93fa02ff106ec6

SHA512
e39d5d0c0042ac6925d399a98f2006beb0ce67dde839cf04a61b352912a1332df6ee1e12aae017bd19236f70f15c140a57d6e01e5b21cd1322ed3f6a61b361a8

Download Submit
\Windows\system\cMZnYWt.exe

Filesize
2.1MB

MD5
f0f517d2c968a0259835703b662f188b

SHA1
c0c598050078fe3becd34aaf69f52c21c75b8b3b

SHA256
e2c21ca8ef8d43f99a51d5c45b514e8926c84d7cd80c1b90da8a4497b3248226

SHA512
12ae93875ddae1ced16468586e14742b505f2c0ed688a152a41958e5a75119d2ea7b10a5d78b4dd24aacdaba7ffc05d929a91e2559791ccb0010ddc3372a3a4e

Download Submit
\Windows\system\wwrQYVv.exe

Filesize
2.1MB

MD5
06eaf244706f3d98d1c2eb32d84f3326

SHA1
35e7495ef2d7918bebc9d182fb613af8d556ac03

SHA256
50fc7f89c3425ae8756b370c1acaa96119522c97323f6f519a2c6a5cc25ef2c0

SHA512
ac8aabe399b6bf4cd08308b20c5758af5573486b766cb260cebf360871b2f4b889ec5c7096bf9a314a8e39df2052fcd8a320680483098cbd9a10905cdfad858a

Download Submit
memory/328-138-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/328-5341-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/1680-107-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/1680-135-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/1680-10351-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1680-1-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1680-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1680-18-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/1680-137-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1680-136-0x0000000003320000-0x0000000003712000-memory.dmp

Filesize
3.9MB

Download
memory/1680-7-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/1680-133-0x0000000003320000-0x0000000003712000-memory.dmp

Filesize
3.9MB

Download
memory/1680-84-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/1680-126-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/1680-89-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/1680-91-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2396-139-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2396-5339-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-5345-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2408-102-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2456-90-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-5350-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-111-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2488-5404-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2520-9-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2520-5400-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2692-81-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-5348-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-5344-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-20-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-93-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/2848-147-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/2848-22-0x000007FEF5D4E000-0x000007FEF5D4F000-memory.dmp

Filesize
4KB

Download
memory/2848-40-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2848-74-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/2848-140-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/2848-21-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2848-41-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2856-5347-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2856-134-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2880-5355-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2880-86-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-5354-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-127-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download