xmrig | 0238489f512946e93b4c30d424aa27e88671b03874fcf365d94d6b1250ed542f

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
Size

1.9MB
MD5

1216dcc48de84ce56fd54b358c0d3260
SHA1

511e53af67ce9916f6fdde98eb7061f9cbb20e7d
SHA256

0238489f512946e93b4c30d424aa27e88671b03874fcf365d94d6b1250ed542f
SHA512

9536912bbfa73e50b94aaa44c51cb1cce29f1c85e474c0f1b60a19b7a6e766fca7dbf675ad57ca37e08b12385062d29133917cc402b13110e069dfc262aa9814
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafQg:NABQ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2768-9-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2652-33-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2164-26-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2516-24-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2428-56-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2504-303-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2964-308-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/1916-96-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2200-88-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2504-86-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2408-80-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2340-72-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2516-1786-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2164-1803-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2768-1789-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2652-1788-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2964-1888-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2888-2473-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2408-2509-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2428-2508-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2340-2938-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2488-3026-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/1916-3056-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2200-3081-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2840	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2768	ejgUHxW.exe
2516	PKgpkPI.exe
2164	lAizDrD.exe
2652	semypbn.exe
2964	IqEmoWs.exe
2428	rFhgIYf.exe
2888	hvJKzDC.exe
2340	bTlfTsX.exe
2488	eAqQyxf.exe
2408	OTQAZOS.exe
2200	jqMWnEa.exe
1916	aTlUehp.exe
2692	LtuHqRy.exe
1656	IDCkIRH.exe
1072	GNSWSlv.exe
1980	UQfRfql.exe
1964	PXWaHpd.exe
856	nDGzIeV.exe
1572	LPvxnMa.exe
2972	OEWRMGh.exe
2000	NxRgwub.exe
1920	QYVjWno.exe
1716	vdBkzAs.exe
2064	pIRblxd.exe
1496	KwbTePr.exe
2356	DLIXPXz.exe
1748	HWdeFjT.exe
1100	ujBGKNe.exe
940	JzprVvt.exe
704	vyRjbii.exe
668	qYjEVOY.exe
2924	IYXIWkw.exe
2044	DDZtXAB.exe
1632	twVKzKV.exe
1808	hyulEon.exe
604	mRxPznq.exe
952	mZkWaBh.exe
1560	aDdTvzk.exe
340	ueyePuK.exe
1092	EnYLDew.exe
1424	yIQpWzr.exe
1392	ArUNocA.exe
1312	UryHYHv.exe
2272	OlPEiAe.exe
1260	RGLQrdX.exe
1700	ANjrjWF.exe
572	TMPzTJF.exe
2180	ktJBvuT.exe
1744	kxUCUPI.exe
1404	feccvSn.exe
2928	qPsNgbD.exe
1756	mzmptfk.exe
1108	VYYqBXH.exe
924	itYegor.exe
1692	vFINwFS.exe
1608	dtPmlFm.exe
1708	bpHNnPz.exe
2884	GDIOrGR.exe
2936	UrmPWig.exe
2636	doamYmC.exe
2724	TGspAMy.exe
2628	mKhoCJa.exe
2596	dvPlQax.exe
2908	GxbCZth.exe

Loads dropped DLL 64 IoCs

pid	Process
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2504-0-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x0009000000016332-5.dat	upx
behavioral1/memory/2768-9-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/files/0x0028000000016b5e-13.dat	upx
behavioral1/files/0x0008000000016c90-17.dat	upx
behavioral1/files/0x0007000000016ca9-21.dat	upx
behavioral1/memory/2964-40-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2652-33-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2164-26-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/files/0x0009000000016ccf-37.dat	upx
behavioral1/memory/2516-24-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x0010000000016c10-74.dat	upx
behavioral1/memory/2428-56-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x0005000000019485-82.dat	upx
behavioral1/files/0x00050000000194a4-89.dat	upx
behavioral1/files/0x00040000000194d8-99.dat	upx
behavioral1/files/0x00040000000194dc-104.dat	upx
behavioral1/files/0x00050000000194e8-110.dat	upx
behavioral1/files/0x0005000000019570-150.dat	upx
behavioral1/files/0x0005000000019570-148.dat	upx
behavioral1/files/0x00050000000195a7-173.dat	upx
behavioral1/files/0x0005000000019547-145.dat	upx
behavioral1/files/0x00050000000195a6-181.dat	upx
behavioral1/memory/2504-303-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2964-308-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x00050000000195a8-184.dat	upx
behavioral1/files/0x00050000000195a2-180.dat	upx
behavioral1/files/0x000500000001959c-179.dat	upx
behavioral1/files/0x00050000000195a7-177.dat	upx
behavioral1/files/0x000500000001950c-170.dat	upx
behavioral1/files/0x00050000000194f2-130.dat	upx
behavioral1/files/0x00050000000195a4-166.dat	upx
behavioral1/files/0x000500000001959e-158.dat	upx
behavioral1/files/0x0005000000019521-142.dat	upx
behavioral1/files/0x00050000000194ee-120.dat	upx
behavioral1/files/0x00050000000194f4-134.dat	upx
behavioral1/files/0x00050000000194ef-124.dat	upx
behavioral1/files/0x00050000000194ea-113.dat	upx
behavioral1/memory/1916-96-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2200-88-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2504-86-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2408-80-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2488-78-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-66.dat	upx
behavioral1/files/0x00040000000194d6-92.dat	upx
behavioral1/files/0x000500000001946f-53.dat	upx
behavioral1/memory/2340-72-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2504-70-0x00000000031F0000-0x00000000035E2000-memory.dmp	upx
behavioral1/memory/2888-62-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x0005000000019473-60.dat	upx
behavioral1/files/0x000800000001704f-49.dat	upx
behavioral1/memory/2516-1786-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2164-1803-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2768-1789-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2652-1788-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2964-1888-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2888-2473-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2408-2509-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2428-2508-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2340-2938-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2488-3026-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/1916-3056-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2200-3081-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dzZYyBv.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\SjjDjUK.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\sVYvpMa.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\EcGcDXi.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\knsvPSK.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\ZQcsOYP.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\YgvkFea.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\QfzQWtC.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\ChUSurn.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\QtZPbia.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\YVZIZiK.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\yRLCdCM.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\AWDafDF.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\msHFdZb.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\PJqvjBZ.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\IssIAdk.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\osxoQGx.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\sNiLCZU.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\XAlkozE.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\JtrefLv.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\cdCQjXl.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\IPqnIbs.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\ZiJhVGw.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\abEkESl.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\yKfBCcl.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\GEhcSNu.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\dwwtSVq.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\EpMlWSX.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\yVnxViH.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\HtZCtuO.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\PiTOofT.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\fiSpiBX.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\NgCHWzt.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\AzHVmsU.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\pjGFpOR.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\kPAfsVG.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\dparvrd.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\VmnDmhv.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\KaCRkII.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\RhdTBMJ.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\ubfIgWb.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\Nauajgv.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\UhjiHiW.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\MyZkBqZ.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\JlIGysY.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\sjWKuED.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\ddWErjh.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\vSNfSjB.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\wvJEAqM.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\ntDLcSu.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\yWTVRpj.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\SFiEwLN.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\xkOhglH.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\pLeGDeL.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\jSxTlqL.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\JsOfRLf.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\EnfktPZ.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\YJUVFdo.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\bqveQOj.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\vyQfdEM.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\LxwVvgy.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\UCjOsNN.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\lxjypxZ.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
File created	C:\Windows\System\IQZvdba.exe	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
Token: SeDebugPrivilege	2840	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2840	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	29
PID 2504 wrote to memory of 2840	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	29
PID 2504 wrote to memory of 2840	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	29
PID 2504 wrote to memory of 2768	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	30
PID 2504 wrote to memory of 2768	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	30
PID 2504 wrote to memory of 2768	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	30
PID 2504 wrote to memory of 2516	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	31
PID 2504 wrote to memory of 2516	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	31
PID 2504 wrote to memory of 2516	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	31
PID 2504 wrote to memory of 2164	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	32
PID 2504 wrote to memory of 2164	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	32
PID 2504 wrote to memory of 2164	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	32
PID 2504 wrote to memory of 2652	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	33
PID 2504 wrote to memory of 2652	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	33
PID 2504 wrote to memory of 2652	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	33
PID 2504 wrote to memory of 2964	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	34
PID 2504 wrote to memory of 2964	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	34
PID 2504 wrote to memory of 2964	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	34
PID 2504 wrote to memory of 2340	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	35
PID 2504 wrote to memory of 2340	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	35
PID 2504 wrote to memory of 2340	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	35
PID 2504 wrote to memory of 2428	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	36
PID 2504 wrote to memory of 2428	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	36
PID 2504 wrote to memory of 2428	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	36
PID 2504 wrote to memory of 2488	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	37
PID 2504 wrote to memory of 2488	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	37
PID 2504 wrote to memory of 2488	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	37
PID 2504 wrote to memory of 2888	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	38
PID 2504 wrote to memory of 2888	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	38
PID 2504 wrote to memory of 2888	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	38
PID 2504 wrote to memory of 2200	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	39
PID 2504 wrote to memory of 2200	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	39
PID 2504 wrote to memory of 2200	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	39
PID 2504 wrote to memory of 2408	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	40
PID 2504 wrote to memory of 2408	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	40
PID 2504 wrote to memory of 2408	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	40
PID 2504 wrote to memory of 1916	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	41
PID 2504 wrote to memory of 1916	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	41
PID 2504 wrote to memory of 1916	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	41
PID 2504 wrote to memory of 2692	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	42
PID 2504 wrote to memory of 2692	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	42
PID 2504 wrote to memory of 2692	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	42
PID 2504 wrote to memory of 1656	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	43
PID 2504 wrote to memory of 1656	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	43
PID 2504 wrote to memory of 1656	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	43
PID 2504 wrote to memory of 1072	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	44
PID 2504 wrote to memory of 1072	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	44
PID 2504 wrote to memory of 1072	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	44
PID 2504 wrote to memory of 1980	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	45
PID 2504 wrote to memory of 1980	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	45
PID 2504 wrote to memory of 1980	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	45
PID 2504 wrote to memory of 1964	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	46
PID 2504 wrote to memory of 1964	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	46
PID 2504 wrote to memory of 1964	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	46
PID 2504 wrote to memory of 856	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	47
PID 2504 wrote to memory of 856	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	47
PID 2504 wrote to memory of 856	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	47
PID 2504 wrote to memory of 1572	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	48
PID 2504 wrote to memory of 1572	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	48
PID 2504 wrote to memory of 1572	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	48
PID 2504 wrote to memory of 2972	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	49
PID 2504 wrote to memory of 2972	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	49
PID 2504 wrote to memory of 2972	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	49
PID 2504 wrote to memory of 2000	2504	1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1216dcc48de84ce56fd54b358c0d3260_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\System\ejgUHxW.exe
  C:\Windows\System\ejgUHxW.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\PKgpkPI.exe
  C:\Windows\System\PKgpkPI.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\lAizDrD.exe
  C:\Windows\System\lAizDrD.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\semypbn.exe
  C:\Windows\System\semypbn.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\IqEmoWs.exe
  C:\Windows\System\IqEmoWs.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\bTlfTsX.exe
  C:\Windows\System\bTlfTsX.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\rFhgIYf.exe
  C:\Windows\System\rFhgIYf.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\eAqQyxf.exe
  C:\Windows\System\eAqQyxf.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\hvJKzDC.exe
  C:\Windows\System\hvJKzDC.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\jqMWnEa.exe
  C:\Windows\System\jqMWnEa.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\OTQAZOS.exe
  C:\Windows\System\OTQAZOS.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\aTlUehp.exe
  C:\Windows\System\aTlUehp.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\LtuHqRy.exe
  C:\Windows\System\LtuHqRy.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\IDCkIRH.exe
  C:\Windows\System\IDCkIRH.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\GNSWSlv.exe
  C:\Windows\System\GNSWSlv.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\UQfRfql.exe
  C:\Windows\System\UQfRfql.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\PXWaHpd.exe
  C:\Windows\System\PXWaHpd.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\nDGzIeV.exe
  C:\Windows\System\nDGzIeV.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\LPvxnMa.exe
  C:\Windows\System\LPvxnMa.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\OEWRMGh.exe
  C:\Windows\System\OEWRMGh.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\NxRgwub.exe
  C:\Windows\System\NxRgwub.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\DLIXPXz.exe
  C:\Windows\System\DLIXPXz.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\QYVjWno.exe
  C:\Windows\System\QYVjWno.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\ujBGKNe.exe
  C:\Windows\System\ujBGKNe.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\vdBkzAs.exe
  C:\Windows\System\vdBkzAs.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\JzprVvt.exe
  C:\Windows\System\JzprVvt.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\pIRblxd.exe
  C:\Windows\System\pIRblxd.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\vyRjbii.exe
  C:\Windows\System\vyRjbii.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\KwbTePr.exe
  C:\Windows\System\KwbTePr.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\qYjEVOY.exe
  C:\Windows\System\qYjEVOY.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\HWdeFjT.exe
  C:\Windows\System\HWdeFjT.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\IYXIWkw.exe
  C:\Windows\System\IYXIWkw.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\DDZtXAB.exe
  C:\Windows\System\DDZtXAB.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\hyulEon.exe
  C:\Windows\System\hyulEon.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\twVKzKV.exe
  C:\Windows\System\twVKzKV.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\mRxPznq.exe
  C:\Windows\System\mRxPznq.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\mZkWaBh.exe
  C:\Windows\System\mZkWaBh.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\aDdTvzk.exe
  C:\Windows\System\aDdTvzk.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\ueyePuK.exe
  C:\Windows\System\ueyePuK.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\EnYLDew.exe
  C:\Windows\System\EnYLDew.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\yIQpWzr.exe
  C:\Windows\System\yIQpWzr.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\ArUNocA.exe
  C:\Windows\System\ArUNocA.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\UryHYHv.exe
  C:\Windows\System\UryHYHv.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\RGLQrdX.exe
  C:\Windows\System\RGLQrdX.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\OlPEiAe.exe
  C:\Windows\System\OlPEiAe.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\ANjrjWF.exe
  C:\Windows\System\ANjrjWF.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\TMPzTJF.exe
  C:\Windows\System\TMPzTJF.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\ktJBvuT.exe
  C:\Windows\System\ktJBvuT.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\kxUCUPI.exe
  C:\Windows\System\kxUCUPI.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\feccvSn.exe
  C:\Windows\System\feccvSn.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\qPsNgbD.exe
  C:\Windows\System\qPsNgbD.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\mzmptfk.exe
  C:\Windows\System\mzmptfk.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\VYYqBXH.exe
  C:\Windows\System\VYYqBXH.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\itYegor.exe
  C:\Windows\System\itYegor.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\vFINwFS.exe
  C:\Windows\System\vFINwFS.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\dtPmlFm.exe
  C:\Windows\System\dtPmlFm.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\bpHNnPz.exe
  C:\Windows\System\bpHNnPz.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\GDIOrGR.exe
  C:\Windows\System\GDIOrGR.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\UrmPWig.exe
  C:\Windows\System\UrmPWig.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\doamYmC.exe
  C:\Windows\System\doamYmC.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\TGspAMy.exe
  C:\Windows\System\TGspAMy.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\mKhoCJa.exe
  C:\Windows\System\mKhoCJa.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\dvPlQax.exe
  C:\Windows\System\dvPlQax.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\GxbCZth.exe
  C:\Windows\System\GxbCZth.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\NRUfvRh.exe
  C:\Windows\System\NRUfvRh.exe
  2⤵
  PID:1640
- C:\Windows\System\zgZrnDl.exe
  C:\Windows\System\zgZrnDl.exe
  2⤵
  PID:2676
- C:\Windows\System\BSOuSEp.exe
  C:\Windows\System\BSOuSEp.exe
  2⤵
  PID:2856
- C:\Windows\System\DiVhKWO.exe
  C:\Windows\System\DiVhKWO.exe
  2⤵
  PID:968
- C:\Windows\System\YxDLCzA.exe
  C:\Windows\System\YxDLCzA.exe
  2⤵
  PID:2004
- C:\Windows\System\DgfMGQt.exe
  C:\Windows\System\DgfMGQt.exe
  2⤵
  PID:2512
- C:\Windows\System\JnEcmck.exe
  C:\Windows\System\JnEcmck.exe
  2⤵
  PID:2492
- C:\Windows\System\DTRWEgS.exe
  C:\Windows\System\DTRWEgS.exe
  2⤵
  PID:832
- C:\Windows\System\vTWJWGe.exe
  C:\Windows\System\vTWJWGe.exe
  2⤵
  PID:2352
- C:\Windows\System\HaqeEoD.exe
  C:\Windows\System\HaqeEoD.exe
  2⤵
  PID:524
- C:\Windows\System\OksrKLb.exe
  C:\Windows\System\OksrKLb.exe
  2⤵
  PID:2436
- C:\Windows\System\wyeVHAk.exe
  C:\Windows\System\wyeVHAk.exe
  2⤵
  PID:1532
- C:\Windows\System\CbRWwtV.exe
  C:\Windows\System\CbRWwtV.exe
  2⤵
  PID:1968
- C:\Windows\System\TVcojHN.exe
  C:\Windows\System\TVcojHN.exe
  2⤵
  PID:1936
- C:\Windows\System\NXpAHFu.exe
  C:\Windows\System\NXpAHFu.exe
  2⤵
  PID:1836
- C:\Windows\System\DRowALl.exe
  C:\Windows\System\DRowALl.exe
  2⤵
  PID:1648
- C:\Windows\System\pvWgDpV.exe
  C:\Windows\System\pvWgDpV.exe
  2⤵
  PID:2360
- C:\Windows\System\xFlUfTi.exe
  C:\Windows\System\xFlUfTi.exe
  2⤵
  PID:1272
- C:\Windows\System\jCzJVqi.exe
  C:\Windows\System\jCzJVqi.exe
  2⤵
  PID:464
- C:\Windows\System\CJSZhbX.exe
  C:\Windows\System\CJSZhbX.exe
  2⤵
  PID:2468
- C:\Windows\System\ZKFTdPf.exe
  C:\Windows\System\ZKFTdPf.exe
  2⤵
  PID:432
- C:\Windows\System\efErkav.exe
  C:\Windows\System\efErkav.exe
  2⤵
  PID:2792
- C:\Windows\System\lqVqrvD.exe
  C:\Windows\System\lqVqrvD.exe
  2⤵
  PID:2108
- C:\Windows\System\QNaLMYh.exe
  C:\Windows\System\QNaLMYh.exe
  2⤵
  PID:1552
- C:\Windows\System\dNDDGDy.exe
  C:\Windows\System\dNDDGDy.exe
  2⤵
  PID:2400
- C:\Windows\System\AQWOLzn.exe
  C:\Windows\System\AQWOLzn.exe
  2⤵
  PID:688
- C:\Windows\System\gVIhrjH.exe
  C:\Windows\System\gVIhrjH.exe
  2⤵
  PID:2388
- C:\Windows\System\xGyvqtw.exe
  C:\Windows\System\xGyvqtw.exe
  2⤵
  PID:2796
- C:\Windows\System\qRnZMPy.exe
  C:\Windows\System\qRnZMPy.exe
  2⤵
  PID:1068
- C:\Windows\System\sudgyQE.exe
  C:\Windows\System\sudgyQE.exe
  2⤵
  PID:1500
- C:\Windows\System\pCHyzDU.exe
  C:\Windows\System\pCHyzDU.exe
  2⤵
  PID:1628
- C:\Windows\System\TbYVOgn.exe
  C:\Windows\System\TbYVOgn.exe
  2⤵
  PID:1832
- C:\Windows\System\ycZmzVp.exe
  C:\Windows\System\ycZmzVp.exe
  2⤵
  PID:1020
- C:\Windows\System\thJSZCL.exe
  C:\Windows\System\thJSZCL.exe
  2⤵
  PID:2308
- C:\Windows\System\qibAENx.exe
  C:\Windows\System\qibAENx.exe
  2⤵
  PID:1176
- C:\Windows\System\CdopdfS.exe
  C:\Windows\System\CdopdfS.exe
  2⤵
  PID:2484
- C:\Windows\System\hHDVgiO.exe
  C:\Windows\System\hHDVgiO.exe
  2⤵
  PID:804
- C:\Windows\System\qznPDgr.exe
  C:\Windows\System\qznPDgr.exe
  2⤵
  PID:1728
- C:\Windows\System\NxQeYtZ.exe
  C:\Windows\System\NxQeYtZ.exe
  2⤵
  PID:1616
- C:\Windows\System\NPEMDbt.exe
  C:\Windows\System\NPEMDbt.exe
  2⤵
  PID:2688
- C:\Windows\System\DpsAdJG.exe
  C:\Windows\System\DpsAdJG.exe
  2⤵
  PID:2780
- C:\Windows\System\oiBSsDS.exe
  C:\Windows\System\oiBSsDS.exe
  2⤵
  PID:2444
- C:\Windows\System\YDaXJYx.exe
  C:\Windows\System\YDaXJYx.exe
  2⤵
  PID:2532
- C:\Windows\System\UYKqDLR.exe
  C:\Windows\System\UYKqDLR.exe
  2⤵
  PID:2868
- C:\Windows\System\GQLqGOw.exe
  C:\Windows\System\GQLqGOw.exe
  2⤵
  PID:560
- C:\Windows\System\dQPHBfG.exe
  C:\Windows\System\dQPHBfG.exe
  2⤵
  PID:2332
- C:\Windows\System\eBnXFWp.exe
  C:\Windows\System\eBnXFWp.exe
  2⤵
  PID:2540
- C:\Windows\System\uYtutgr.exe
  C:\Windows\System\uYtutgr.exe
  2⤵
  PID:1932
- C:\Windows\System\OhXdyoe.exe
  C:\Windows\System\OhXdyoe.exe
  2⤵
  PID:1896
- C:\Windows\System\NsFbUsn.exe
  C:\Windows\System\NsFbUsn.exe
  2⤵
  PID:776
- C:\Windows\System\XDBEPXW.exe
  C:\Windows\System\XDBEPXW.exe
  2⤵
  PID:1820
- C:\Windows\System\aULHfIQ.exe
  C:\Windows\System\aULHfIQ.exe
  2⤵
  PID:1384
- C:\Windows\System\kEbKBrc.exe
  C:\Windows\System\kEbKBrc.exe
  2⤵
  PID:1220
- C:\Windows\System\yNtnupx.exe
  C:\Windows\System\yNtnupx.exe
  2⤵
  PID:1344
- C:\Windows\System\XlyIcwh.exe
  C:\Windows\System\XlyIcwh.exe
  2⤵
  PID:328
- C:\Windows\System\gQhRumP.exe
  C:\Windows\System\gQhRumP.exe
  2⤵
  PID:1452
- C:\Windows\System\IqHUQpp.exe
  C:\Windows\System\IqHUQpp.exe
  2⤵
  PID:648
- C:\Windows\System\IbMzZmw.exe
  C:\Windows\System\IbMzZmw.exe
  2⤵
  PID:3032
- C:\Windows\System\GUkqgIL.exe
  C:\Windows\System\GUkqgIL.exe
  2⤵
  PID:2520
- C:\Windows\System\piFiKgX.exe
  C:\Windows\System\piFiKgX.exe
  2⤵
  PID:2880
- C:\Windows\System\AgmKFCc.exe
  C:\Windows\System\AgmKFCc.exe
  2⤵
  PID:584
- C:\Windows\System\LaqMaCW.exe
  C:\Windows\System\LaqMaCW.exe
  2⤵
  PID:948
- C:\Windows\System\HLSTvWD.exe
  C:\Windows\System\HLSTvWD.exe
  2⤵
  PID:2968
- C:\Windows\System\YDxYxtU.exe
  C:\Windows\System\YDxYxtU.exe
  2⤵
  PID:1676
- C:\Windows\System\kOZjAUr.exe
  C:\Windows\System\kOZjAUr.exe
  2⤵
  PID:1988
- C:\Windows\System\dMVLCwU.exe
  C:\Windows\System\dMVLCwU.exe
  2⤵
  PID:1636
- C:\Windows\System\cJBEhcI.exe
  C:\Windows\System\cJBEhcI.exe
  2⤵
  PID:2656
- C:\Windows\System\ymyGpHr.exe
  C:\Windows\System\ymyGpHr.exe
  2⤵
  PID:456
- C:\Windows\System\pqezkQq.exe
  C:\Windows\System\pqezkQq.exe
  2⤵
  PID:3060
- C:\Windows\System\zUlOAKC.exe
  C:\Windows\System\zUlOAKC.exe
  2⤵
  PID:2264
- C:\Windows\System\zENgGuz.exe
  C:\Windows\System\zENgGuz.exe
  2⤵
  PID:2764
- C:\Windows\System\iHmuSzt.exe
  C:\Windows\System\iHmuSzt.exe
  2⤵
  PID:3052
- C:\Windows\System\haZlULc.exe
  C:\Windows\System\haZlULc.exe
  2⤵
  PID:1740
- C:\Windows\System\eVjEhfp.exe
  C:\Windows\System\eVjEhfp.exe
  2⤵
  PID:840
- C:\Windows\System\JUTcOox.exe
  C:\Windows\System\JUTcOox.exe
  2⤵
  PID:2268
- C:\Windows\System\yOHiewO.exe
  C:\Windows\System\yOHiewO.exe
  2⤵
  PID:672
- C:\Windows\System\LPugqRu.exe
  C:\Windows\System\LPugqRu.exe
  2⤵
  PID:944
- C:\Windows\System\VzvlQiC.exe
  C:\Windows\System\VzvlQiC.exe
  2⤵
  PID:2852
- C:\Windows\System\QkhyGPw.exe
  C:\Windows\System\QkhyGPw.exe
  2⤵
  PID:1996
- C:\Windows\System\QLMmioB.exe
  C:\Windows\System\QLMmioB.exe
  2⤵
  PID:1400
- C:\Windows\System\THuiWPF.exe
  C:\Windows\System\THuiWPF.exe
  2⤵
  PID:520
- C:\Windows\System\EILOKzN.exe
  C:\Windows\System\EILOKzN.exe
  2⤵
  PID:1672
- C:\Windows\System\lDhDKBD.exe
  C:\Windows\System\lDhDKBD.exe
  2⤵
  PID:1364
- C:\Windows\System\SCIJrFw.exe
  C:\Windows\System\SCIJrFw.exe
  2⤵
  PID:2072
- C:\Windows\System\oVMgyiI.exe
  C:\Windows\System\oVMgyiI.exe
  2⤵
  PID:2572
- C:\Windows\System\tKyLWkW.exe
  C:\Windows\System\tKyLWkW.exe
  2⤵
  PID:1884
- C:\Windows\System\TXSlqxZ.exe
  C:\Windows\System\TXSlqxZ.exe
  2⤵
  PID:3024
- C:\Windows\System\ZJlCCiQ.exe
  C:\Windows\System\ZJlCCiQ.exe
  2⤵
  PID:2368
- C:\Windows\System\AgtpmUD.exe
  C:\Windows\System\AgtpmUD.exe
  2⤵
  PID:2184
- C:\Windows\System\lnaAJrj.exe
  C:\Windows\System\lnaAJrj.exe
  2⤵
  PID:872
- C:\Windows\System\pVmSMVz.exe
  C:\Windows\System\pVmSMVz.exe
  2⤵
  PID:2828
- C:\Windows\System\PVToYqo.exe
  C:\Windows\System\PVToYqo.exe
  2⤵
  PID:1828
- C:\Windows\System\wcHuKfz.exe
  C:\Windows\System\wcHuKfz.exe
  2⤵
  PID:2932
- C:\Windows\System\HPgcFMA.exe
  C:\Windows\System\HPgcFMA.exe
  2⤵
  PID:2756
- C:\Windows\System\PLqufos.exe
  C:\Windows\System\PLqufos.exe
  2⤵
  PID:2820
- C:\Windows\System\hMZQPMg.exe
  C:\Windows\System\hMZQPMg.exe
  2⤵
  PID:2808
- C:\Windows\System\VNfohwN.exe
  C:\Windows\System\VNfohwN.exe
  2⤵
  PID:3028
- C:\Windows\System\UdPxuIk.exe
  C:\Windows\System\UdPxuIk.exe
  2⤵
  PID:1524
- C:\Windows\System\KuHtNnu.exe
  C:\Windows\System\KuHtNnu.exe
  2⤵
  PID:828
- C:\Windows\System\RhdTBMJ.exe
  C:\Windows\System\RhdTBMJ.exe
  2⤵
  PID:1720
- C:\Windows\System\uTFhenI.exe
  C:\Windows\System\uTFhenI.exe
  2⤵
  PID:624
- C:\Windows\System\iDeHFnm.exe
  C:\Windows\System\iDeHFnm.exe
  2⤵
  PID:2576
- C:\Windows\System\tMnSslE.exe
  C:\Windows\System\tMnSslE.exe
  2⤵
  PID:2240
- C:\Windows\System\CMXIbPv.exe
  C:\Windows\System\CMXIbPv.exe
  2⤵
  PID:2260
- C:\Windows\System\vrpsKQs.exe
  C:\Windows\System\vrpsKQs.exe
  2⤵
  PID:768
- C:\Windows\System\pjGFpOR.exe
  C:\Windows\System\pjGFpOR.exe
  2⤵
  PID:808
- C:\Windows\System\xRsCuRI.exe
  C:\Windows\System\xRsCuRI.exe
  2⤵
  PID:1544
- C:\Windows\System\JtaXRjO.exe
  C:\Windows\System\JtaXRjO.exe
  2⤵
  PID:2168
- C:\Windows\System\IgCcKAv.exe
  C:\Windows\System\IgCcKAv.exe
  2⤵
  PID:1492
- C:\Windows\System\FodlMVH.exe
  C:\Windows\System\FodlMVH.exe
  2⤵
  PID:980
- C:\Windows\System\pvrrdRp.exe
  C:\Windows\System\pvrrdRp.exe
  2⤵
  PID:1940
- C:\Windows\System\makRGMI.exe
  C:\Windows\System\makRGMI.exe
  2⤵
  PID:1088
- C:\Windows\System\YFohmOP.exe
  C:\Windows\System\YFohmOP.exe
  2⤵
  PID:2536
- C:\Windows\System\iMBlBmk.exe
  C:\Windows\System\iMBlBmk.exe
  2⤵
  PID:1724
- C:\Windows\System\ekJeuoh.exe
  C:\Windows\System\ekJeuoh.exe
  2⤵
  PID:1972
- C:\Windows\System\Wglimbz.exe
  C:\Windows\System\Wglimbz.exe
  2⤵
  PID:3084
- C:\Windows\System\tqaAWuB.exe
  C:\Windows\System\tqaAWuB.exe
  2⤵
  PID:3104
- C:\Windows\System\BYjiqvl.exe
  C:\Windows\System\BYjiqvl.exe
  2⤵
  PID:3120
- C:\Windows\System\nIeothX.exe
  C:\Windows\System\nIeothX.exe
  2⤵
  PID:3136
- C:\Windows\System\mxGcCaV.exe
  C:\Windows\System\mxGcCaV.exe
  2⤵
  PID:3152
- C:\Windows\System\kPAfsVG.exe
  C:\Windows\System\kPAfsVG.exe
  2⤵
  PID:3168
- C:\Windows\System\AkAKLuo.exe
  C:\Windows\System\AkAKLuo.exe
  2⤵
  PID:3184
- C:\Windows\System\aqKlRin.exe
  C:\Windows\System\aqKlRin.exe
  2⤵
  PID:3200
- C:\Windows\System\NXlnfUL.exe
  C:\Windows\System\NXlnfUL.exe
  2⤵
  PID:3220
- C:\Windows\System\bkKWxUD.exe
  C:\Windows\System\bkKWxUD.exe
  2⤵
  PID:3240
- C:\Windows\System\YdEEMpd.exe
  C:\Windows\System\YdEEMpd.exe
  2⤵
  PID:3256
- C:\Windows\System\RMidYpN.exe
  C:\Windows\System\RMidYpN.exe
  2⤵
  PID:3276
- C:\Windows\System\BjNViZd.exe
  C:\Windows\System\BjNViZd.exe
  2⤵
  PID:3292
- C:\Windows\System\sbbHwbI.exe
  C:\Windows\System\sbbHwbI.exe
  2⤵
  PID:3308
- C:\Windows\System\tRhZdUb.exe
  C:\Windows\System\tRhZdUb.exe
  2⤵
  PID:3324
- C:\Windows\System\oyTMdYw.exe
  C:\Windows\System\oyTMdYw.exe
  2⤵
  PID:3340
- C:\Windows\System\eFHKuRs.exe
  C:\Windows\System\eFHKuRs.exe
  2⤵
  PID:3356
- C:\Windows\System\GwvNCQt.exe
  C:\Windows\System\GwvNCQt.exe
  2⤵
  PID:3372
- C:\Windows\System\oIpVLyW.exe
  C:\Windows\System\oIpVLyW.exe
  2⤵
  PID:3388
- C:\Windows\System\JBTNpta.exe
  C:\Windows\System\JBTNpta.exe
  2⤵
  PID:3408
- C:\Windows\System\vinRNhi.exe
  C:\Windows\System\vinRNhi.exe
  2⤵
  PID:3432
- C:\Windows\System\MFQVIli.exe
  C:\Windows\System\MFQVIli.exe
  2⤵
  PID:3452
- C:\Windows\System\OIfZmVR.exe
  C:\Windows\System\OIfZmVR.exe
  2⤵
  PID:3472
- C:\Windows\System\FEpoXIU.exe
  C:\Windows\System\FEpoXIU.exe
  2⤵
  PID:3492
- C:\Windows\System\gpRlPai.exe
  C:\Windows\System\gpRlPai.exe
  2⤵
  PID:3512
- C:\Windows\System\aEDRFBL.exe
  C:\Windows\System\aEDRFBL.exe
  2⤵
  PID:3528
- C:\Windows\System\cwLqCjB.exe
  C:\Windows\System\cwLqCjB.exe
  2⤵
  PID:3544
- C:\Windows\System\rBSUXbJ.exe
  C:\Windows\System\rBSUXbJ.exe
  2⤵
  PID:3560
- C:\Windows\System\LXzvXoL.exe
  C:\Windows\System\LXzvXoL.exe
  2⤵
  PID:3576
- C:\Windows\System\lrDIHGE.exe
  C:\Windows\System\lrDIHGE.exe
  2⤵
  PID:3608
- C:\Windows\System\uoJYCfl.exe
  C:\Windows\System\uoJYCfl.exe
  2⤵
  PID:3624
- C:\Windows\System\RFfQUXN.exe
  C:\Windows\System\RFfQUXN.exe
  2⤵
  PID:3648
- C:\Windows\System\fmzqEBN.exe
  C:\Windows\System\fmzqEBN.exe
  2⤵
  PID:3668
- C:\Windows\System\cSewjun.exe
  C:\Windows\System\cSewjun.exe
  2⤵
  PID:3684
- C:\Windows\System\ZNlsDbc.exe
  C:\Windows\System\ZNlsDbc.exe
  2⤵
  PID:3700
- C:\Windows\System\VsghXZu.exe
  C:\Windows\System\VsghXZu.exe
  2⤵
  PID:3720
- C:\Windows\System\jrAntwx.exe
  C:\Windows\System\jrAntwx.exe
  2⤵
  PID:3740
- C:\Windows\System\KjRdtPA.exe
  C:\Windows\System\KjRdtPA.exe
  2⤵
  PID:3756
- C:\Windows\System\YrlpPbk.exe
  C:\Windows\System\YrlpPbk.exe
  2⤵
  PID:3772
- C:\Windows\System\YKDGSuQ.exe
  C:\Windows\System\YKDGSuQ.exe
  2⤵
  PID:3788
- C:\Windows\System\ewSxDtY.exe
  C:\Windows\System\ewSxDtY.exe
  2⤵
  PID:3804
- C:\Windows\System\pltCczl.exe
  C:\Windows\System\pltCczl.exe
  2⤵
  PID:3820
- C:\Windows\System\eMQIWKm.exe
  C:\Windows\System\eMQIWKm.exe
  2⤵
  PID:3836
- C:\Windows\System\pPPqeIX.exe
  C:\Windows\System\pPPqeIX.exe
  2⤵
  PID:3852
- C:\Windows\System\lnQjXDh.exe
  C:\Windows\System\lnQjXDh.exe
  2⤵
  PID:3868
- C:\Windows\System\galLWln.exe
  C:\Windows\System\galLWln.exe
  2⤵
  PID:3884
- C:\Windows\System\KAIXbqK.exe
  C:\Windows\System\KAIXbqK.exe
  2⤵
  PID:3900
- C:\Windows\System\TYfFjdp.exe
  C:\Windows\System\TYfFjdp.exe
  2⤵
  PID:3920
- C:\Windows\System\wwgTDEo.exe
  C:\Windows\System\wwgTDEo.exe
  2⤵
  PID:3936
- C:\Windows\System\dciNozM.exe
  C:\Windows\System\dciNozM.exe
  2⤵
  PID:3952
- C:\Windows\System\PnWApXU.exe
  C:\Windows\System\PnWApXU.exe
  2⤵
  PID:3968
- C:\Windows\System\JPwfhry.exe
  C:\Windows\System\JPwfhry.exe
  2⤵
  PID:3984
- C:\Windows\System\kbeSokm.exe
  C:\Windows\System\kbeSokm.exe
  2⤵
  PID:4000
- C:\Windows\System\obLsxdl.exe
  C:\Windows\System\obLsxdl.exe
  2⤵
  PID:4016
- C:\Windows\System\hRSXmkN.exe
  C:\Windows\System\hRSXmkN.exe
  2⤵
  PID:4032
- C:\Windows\System\VpmbeBI.exe
  C:\Windows\System\VpmbeBI.exe
  2⤵
  PID:4048
- C:\Windows\System\JmHKRYe.exe
  C:\Windows\System\JmHKRYe.exe
  2⤵
  PID:4064
- C:\Windows\System\QzkYiZW.exe
  C:\Windows\System\QzkYiZW.exe
  2⤵
  PID:4080
- C:\Windows\System\mjHOyZq.exe
  C:\Windows\System\mjHOyZq.exe
  2⤵
  PID:2948
- C:\Windows\System\JrJwnuo.exe
  C:\Windows\System\JrJwnuo.exe
  2⤵
  PID:3076
- C:\Windows\System\QtLDsxj.exe
  C:\Windows\System\QtLDsxj.exe
  2⤵
  PID:3116
- C:\Windows\System\exWWcaj.exe
  C:\Windows\System\exWWcaj.exe
  2⤵
  PID:2960
- C:\Windows\System\QhkyrgX.exe
  C:\Windows\System\QhkyrgX.exe
  2⤵
  PID:3248
- C:\Windows\System\LLIimbu.exe
  C:\Windows\System\LLIimbu.exe
  2⤵
  PID:3316
- C:\Windows\System\jcFJMTp.exe
  C:\Windows\System\jcFJMTp.exe
  2⤵
  PID:1480
- C:\Windows\System\NOQRTNY.exe
  C:\Windows\System\NOQRTNY.exe
  2⤵
  PID:3100
- C:\Windows\System\BKHVfXV.exe
  C:\Windows\System\BKHVfXV.exe
  2⤵
  PID:3384
- C:\Windows\System\PGvgFcg.exe
  C:\Windows\System\PGvgFcg.exe
  2⤵
  PID:3192
- C:\Windows\System\ODqdzap.exe
  C:\Windows\System\ODqdzap.exe
  2⤵
  PID:3236
- C:\Windows\System\dgjWhCK.exe
  C:\Windows\System\dgjWhCK.exe
  2⤵
  PID:3300
- C:\Windows\System\nfusttR.exe
  C:\Windows\System\nfusttR.exe
  2⤵
  PID:3364
- C:\Windows\System\oaqGzzI.exe
  C:\Windows\System\oaqGzzI.exe
  2⤵
  PID:3420
- C:\Windows\System\pgCxlte.exe
  C:\Windows\System\pgCxlte.exe
  2⤵
  PID:3400
- C:\Windows\System\NuGdpKv.exe
  C:\Windows\System\NuGdpKv.exe
  2⤵
  PID:3460
- C:\Windows\System\xkOhglH.exe
  C:\Windows\System\xkOhglH.exe
  2⤵
  PID:2604
- C:\Windows\System\LXbAYZx.exe
  C:\Windows\System\LXbAYZx.exe
  2⤵
  PID:3480
- C:\Windows\System\sUAJrwL.exe
  C:\Windows\System\sUAJrwL.exe
  2⤵
  PID:3524
- C:\Windows\System\DreMJpE.exe
  C:\Windows\System\DreMJpE.exe
  2⤵
  PID:3540
- C:\Windows\System\DIEzwvg.exe
  C:\Windows\System\DIEzwvg.exe
  2⤵
  PID:3556
- C:\Windows\System\HEoDgUN.exe
  C:\Windows\System\HEoDgUN.exe
  2⤵
  PID:2864
- C:\Windows\System\JYeUNFU.exe
  C:\Windows\System\JYeUNFU.exe
  2⤵
  PID:3656
- C:\Windows\System\IkAacYV.exe
  C:\Windows\System\IkAacYV.exe
  2⤵
  PID:2284
- C:\Windows\System\coZEMvW.exe
  C:\Windows\System\coZEMvW.exe
  2⤵
  PID:3632
- C:\Windows\System\TJeWxmj.exe
  C:\Windows\System\TJeWxmj.exe
  2⤵
  PID:3680
- C:\Windows\System\vCPfLTX.exe
  C:\Windows\System\vCPfLTX.exe
  2⤵
  PID:3728
- C:\Windows\System\eYhKbVC.exe
  C:\Windows\System\eYhKbVC.exe
  2⤵
  PID:3796
- C:\Windows\System\lGCkbAp.exe
  C:\Windows\System\lGCkbAp.exe
  2⤵
  PID:3716
- C:\Windows\System\UXffcUJ.exe
  C:\Windows\System\UXffcUJ.exe
  2⤵
  PID:3892
- C:\Windows\System\ivxjPWe.exe
  C:\Windows\System\ivxjPWe.exe
  2⤵
  PID:3780
- C:\Windows\System\fXKUTct.exe
  C:\Windows\System\fXKUTct.exe
  2⤵
  PID:3960
- C:\Windows\System\bZMtziV.exe
  C:\Windows\System\bZMtziV.exe
  2⤵
  PID:3944
- C:\Windows\System\eOlXitd.exe
  C:\Windows\System\eOlXitd.exe
  2⤵
  PID:3928
- C:\Windows\System\AxtORpC.exe
  C:\Windows\System\AxtORpC.exe
  2⤵
  PID:3736
- C:\Windows\System\zvSPnbZ.exe
  C:\Windows\System\zvSPnbZ.exe
  2⤵
  PID:4056
- C:\Windows\System\uXpsxWS.exe
  C:\Windows\System\uXpsxWS.exe
  2⤵
  PID:4060
- C:\Windows\System\TdkQJpR.exe
  C:\Windows\System\TdkQJpR.exe
  2⤵
  PID:3208
- C:\Windows\System\jSzMbSc.exe
  C:\Windows\System\jSzMbSc.exe
  2⤵
  PID:1944
- C:\Windows\System\PdHSoZa.exe
  C:\Windows\System\PdHSoZa.exe
  2⤵
  PID:1308
- C:\Windows\System\JgBGaMd.exe
  C:\Windows\System\JgBGaMd.exe
  2⤵
  PID:4072
- C:\Windows\System\rwcFKWH.exe
  C:\Windows\System\rwcFKWH.exe
  2⤵
  PID:2668
- C:\Windows\System\EWuUPqD.exe
  C:\Windows\System\EWuUPqD.exe
  2⤵
  PID:3160
- C:\Windows\System\FqyUNHz.exe
  C:\Windows\System\FqyUNHz.exe
  2⤵
  PID:3336
- C:\Windows\System\BtPEVuG.exe
  C:\Windows\System\BtPEVuG.exe
  2⤵
  PID:3428
- C:\Windows\System\NVTwkvd.exe
  C:\Windows\System\NVTwkvd.exe
  2⤵
  PID:1928
- C:\Windows\System\sGinhFa.exe
  C:\Windows\System\sGinhFa.exe
  2⤵
  PID:2124
- C:\Windows\System\YfHYLav.exe
  C:\Windows\System\YfHYLav.exe
  2⤵
  PID:1956
- C:\Windows\System\RdCqGRA.exe
  C:\Windows\System\RdCqGRA.exe
  2⤵
  PID:3520
- C:\Windows\System\ralIuAB.exe
  C:\Windows\System\ralIuAB.exe
  2⤵
  PID:3596
- C:\Windows\System\ubfIgWb.exe
  C:\Windows\System\ubfIgWb.exe
  2⤵
  PID:1036
- C:\Windows\System\oyZuNHl.exe
  C:\Windows\System\oyZuNHl.exe
  2⤵
  PID:3640
- C:\Windows\System\BjUYNLN.exe
  C:\Windows\System\BjUYNLN.exe
  2⤵
  PID:3764
- C:\Windows\System\DzBXgqN.exe
  C:\Windows\System\DzBXgqN.exe
  2⤵
  PID:3816
- C:\Windows\System\wfjCIcF.exe
  C:\Windows\System\wfjCIcF.exe
  2⤵
  PID:3860
- C:\Windows\System\WKKLeLh.exe
  C:\Windows\System\WKKLeLh.exe
  2⤵
  PID:3880
- C:\Windows\System\YmneYOx.exe
  C:\Windows\System\YmneYOx.exe
  2⤵
  PID:3908
- C:\Windows\System\RZBxtXg.exe
  C:\Windows\System\RZBxtXg.exe
  2⤵
  PID:2608
- C:\Windows\System\cArHEvy.exe
  C:\Windows\System\cArHEvy.exe
  2⤵
  PID:3132
- C:\Windows\System\gYWZSYl.exe
  C:\Windows\System\gYWZSYl.exe
  2⤵
  PID:3112
- C:\Windows\System\jehwXLq.exe
  C:\Windows\System\jehwXLq.exe
  2⤵
  PID:3352
- C:\Windows\System\baLrfFp.exe
  C:\Windows\System\baLrfFp.exe
  2⤵
  PID:3440
- C:\Windows\System\lqZFEKG.exe
  C:\Windows\System\lqZFEKG.exe
  2⤵
  PID:3620
- C:\Windows\System\qGtDjic.exe
  C:\Windows\System\qGtDjic.exe
  2⤵
  PID:3752
- C:\Windows\System\vRbFuPp.exe
  C:\Windows\System\vRbFuPp.exe
  2⤵
  PID:2876
- C:\Windows\System\EcUWLUl.exe
  C:\Windows\System\EcUWLUl.exe
  2⤵
  PID:2712
- C:\Windows\System\dZpYCtO.exe
  C:\Windows\System\dZpYCtO.exe
  2⤵
  PID:3536
- C:\Windows\System\FUxvgEy.exe
  C:\Windows\System\FUxvgEy.exe
  2⤵
  PID:4028
- C:\Windows\System\lgepABK.exe
  C:\Windows\System\lgepABK.exe
  2⤵
  PID:3712
- C:\Windows\System\iUTZNvA.exe
  C:\Windows\System\iUTZNvA.exe
  2⤵
  PID:4088
- C:\Windows\System\zUhdghi.exe
  C:\Windows\System\zUhdghi.exe
  2⤵
  PID:3396
- C:\Windows\System\zHpxRIY.exe
  C:\Windows\System\zHpxRIY.exe
  2⤵
  PID:3268
- C:\Windows\System\YlvVvlc.exe
  C:\Windows\System\YlvVvlc.exe
  2⤵
  PID:3980
- C:\Windows\System\PIItAkI.exe
  C:\Windows\System\PIItAkI.exe
  2⤵
  PID:3568
- C:\Windows\System\XXecXWZ.exe
  C:\Windows\System\XXecXWZ.exe
  2⤵
  PID:3164
- C:\Windows\System\CIWTxCV.exe
  C:\Windows\System\CIWTxCV.exe
  2⤵
  PID:3464
- C:\Windows\System\bsgUnMg.exe
  C:\Windows\System\bsgUnMg.exe
  2⤵
  PID:4104
- C:\Windows\System\wcmJNXf.exe
  C:\Windows\System\wcmJNXf.exe
  2⤵
  PID:4120
- C:\Windows\System\CYpXuEE.exe
  C:\Windows\System\CYpXuEE.exe
  2⤵
  PID:4136
- C:\Windows\System\ttpmOrF.exe
  C:\Windows\System\ttpmOrF.exe
  2⤵
  PID:4156
- C:\Windows\System\ajuzHzR.exe
  C:\Windows\System\ajuzHzR.exe
  2⤵
  PID:4176
- C:\Windows\System\yjFYlWd.exe
  C:\Windows\System\yjFYlWd.exe
  2⤵
  PID:4228
- C:\Windows\System\xjufMPC.exe
  C:\Windows\System\xjufMPC.exe
  2⤵
  PID:4244
- C:\Windows\System\HrOFhcf.exe
  C:\Windows\System\HrOFhcf.exe
  2⤵
  PID:4264
- C:\Windows\System\DVmDEmy.exe
  C:\Windows\System\DVmDEmy.exe
  2⤵
  PID:4280
- C:\Windows\System\gkgpccj.exe
  C:\Windows\System\gkgpccj.exe
  2⤵
  PID:4300
- C:\Windows\System\pLeGDeL.exe
  C:\Windows\System\pLeGDeL.exe
  2⤵
  PID:4320
- C:\Windows\System\cOHViIC.exe
  C:\Windows\System\cOHViIC.exe
  2⤵
  PID:4336
- C:\Windows\System\lTzkECc.exe
  C:\Windows\System\lTzkECc.exe
  2⤵
  PID:4352
- C:\Windows\System\NKKUsdA.exe
  C:\Windows\System\NKKUsdA.exe
  2⤵
  PID:4372
- C:\Windows\System\kLevOle.exe
  C:\Windows\System\kLevOle.exe
  2⤵
  PID:4388
- C:\Windows\System\xqqffPW.exe
  C:\Windows\System\xqqffPW.exe
  2⤵
  PID:4408
- C:\Windows\System\iFdqMtX.exe
  C:\Windows\System\iFdqMtX.exe
  2⤵
  PID:4424
- C:\Windows\System\FjnIJEr.exe
  C:\Windows\System\FjnIJEr.exe
  2⤵
  PID:4448
- C:\Windows\System\NyWnIMJ.exe
  C:\Windows\System\NyWnIMJ.exe
  2⤵
  PID:4464
- C:\Windows\System\yMhmGTF.exe
  C:\Windows\System\yMhmGTF.exe
  2⤵
  PID:4484
- C:\Windows\System\aZSrWTf.exe
  C:\Windows\System\aZSrWTf.exe
  2⤵
  PID:4500
- C:\Windows\System\eyQDHMI.exe
  C:\Windows\System\eyQDHMI.exe
  2⤵
  PID:4516
- C:\Windows\System\PpKoTAn.exe
  C:\Windows\System\PpKoTAn.exe
  2⤵
  PID:4536
- C:\Windows\System\eSxjkFi.exe
  C:\Windows\System\eSxjkFi.exe
  2⤵
  PID:4556
- C:\Windows\System\rLVvoRA.exe
  C:\Windows\System\rLVvoRA.exe
  2⤵
  PID:4572
- C:\Windows\System\gnkmfql.exe
  C:\Windows\System\gnkmfql.exe
  2⤵
  PID:4592
- C:\Windows\System\UVkCLlb.exe
  C:\Windows\System\UVkCLlb.exe
  2⤵
  PID:4612
- C:\Windows\System\sVYvpMa.exe
  C:\Windows\System\sVYvpMa.exe
  2⤵
  PID:4628
- C:\Windows\System\Eaegvux.exe
  C:\Windows\System\Eaegvux.exe
  2⤵
  PID:4660
- C:\Windows\System\lAMKnFS.exe
  C:\Windows\System\lAMKnFS.exe
  2⤵
  PID:4728
- C:\Windows\System\rHajGIq.exe
  C:\Windows\System\rHajGIq.exe
  2⤵
  PID:4744
- C:\Windows\System\LEQtoBG.exe
  C:\Windows\System\LEQtoBG.exe
  2⤵
  PID:4764
- C:\Windows\System\IEkhztZ.exe
  C:\Windows\System\IEkhztZ.exe
  2⤵
  PID:4780
- C:\Windows\System\wpOxGgo.exe
  C:\Windows\System\wpOxGgo.exe
  2⤵
  PID:4796
- C:\Windows\System\ysnRZjY.exe
  C:\Windows\System\ysnRZjY.exe
  2⤵
  PID:4812
- C:\Windows\System\BzzMFVH.exe
  C:\Windows\System\BzzMFVH.exe
  2⤵
  PID:4828
- C:\Windows\System\wZAITqx.exe
  C:\Windows\System\wZAITqx.exe
  2⤵
  PID:4848
- C:\Windows\System\SxsCxjm.exe
  C:\Windows\System\SxsCxjm.exe
  2⤵
  PID:4864
- C:\Windows\System\qRlXhFP.exe
  C:\Windows\System\qRlXhFP.exe
  2⤵
  PID:4880
- C:\Windows\System\nmqiiXC.exe
  C:\Windows\System\nmqiiXC.exe
  2⤵
  PID:4896
- C:\Windows\System\SBknuwa.exe
  C:\Windows\System\SBknuwa.exe
  2⤵
  PID:4912
- C:\Windows\System\dITMKwl.exe
  C:\Windows\System\dITMKwl.exe
  2⤵
  PID:4928
- C:\Windows\System\YhvbarC.exe
  C:\Windows\System\YhvbarC.exe
  2⤵
  PID:4944
- C:\Windows\System\pzNUEvy.exe
  C:\Windows\System\pzNUEvy.exe
  2⤵
  PID:4960
- C:\Windows\System\BBewgxR.exe
  C:\Windows\System\BBewgxR.exe
  2⤵
  PID:4976
- C:\Windows\System\BbYnSYE.exe
  C:\Windows\System\BbYnSYE.exe
  2⤵
  PID:4992
- C:\Windows\System\OiMrhTr.exe
  C:\Windows\System\OiMrhTr.exe
  2⤵
  PID:5008
- C:\Windows\System\dIKLlgd.exe
  C:\Windows\System\dIKLlgd.exe
  2⤵
  PID:5024
- C:\Windows\System\DDPQBkx.exe
  C:\Windows\System\DDPQBkx.exe
  2⤵
  PID:5040
- C:\Windows\System\PJDFMcX.exe
  C:\Windows\System\PJDFMcX.exe
  2⤵
  PID:5056
- C:\Windows\System\CWMtMDV.exe
  C:\Windows\System\CWMtMDV.exe
  2⤵
  PID:5072
- C:\Windows\System\fAKQrXG.exe
  C:\Windows\System\fAKQrXG.exe
  2⤵
  PID:5088
- C:\Windows\System\YMIgMeS.exe
  C:\Windows\System\YMIgMeS.exe
  2⤵
  PID:5104
- C:\Windows\System\PUkgVcq.exe
  C:\Windows\System\PUkgVcq.exe
  2⤵
  PID:3148
- C:\Windows\System\bopXUgH.exe
  C:\Windows\System\bopXUgH.exe
  2⤵
  PID:4100
- C:\Windows\System\zjFJyfF.exe
  C:\Windows\System\zjFJyfF.exe
  2⤵
  PID:3844
- C:\Windows\System\AxzvSeX.exe
  C:\Windows\System\AxzvSeX.exe
  2⤵
  PID:4152
- C:\Windows\System\jSxTlqL.exe
  C:\Windows\System\jSxTlqL.exe
  2⤵
  PID:4204
- C:\Windows\System\EvDWaha.exe
  C:\Windows\System\EvDWaha.exe
  2⤵
  PID:4312
- C:\Windows\System\DGdsOzl.exe
  C:\Windows\System\DGdsOzl.exe
  2⤵
  PID:4344
- C:\Windows\System\YbBidkp.exe
  C:\Windows\System\YbBidkp.exe
  2⤵
  PID:4256
- C:\Windows\System\bqveQOj.exe
  C:\Windows\System\bqveQOj.exe
  2⤵
  PID:4296
- C:\Windows\System\vJQbwdv.exe
  C:\Windows\System\vJQbwdv.exe
  2⤵
  PID:4400
- C:\Windows\System\SUvAvCz.exe
  C:\Windows\System\SUvAvCz.exe
  2⤵
  PID:4444
- C:\Windows\System\JGVPZrI.exe
  C:\Windows\System\JGVPZrI.exe
  2⤵
  PID:4508
- C:\Windows\System\yHBnPom.exe
  C:\Windows\System\yHBnPom.exe
  2⤵
  PID:4548
- C:\Windows\System\SUIGBhq.exe
  C:\Windows\System\SUIGBhq.exe
  2⤵
  PID:4584
- C:\Windows\System\rqwyOrr.exe
  C:\Windows\System\rqwyOrr.exe
  2⤵
  PID:4652
- C:\Windows\System\TxbNDPN.exe
  C:\Windows\System\TxbNDPN.exe
  2⤵
  PID:4456
- C:\Windows\System\EWQoBmY.exe
  C:\Windows\System\EWQoBmY.exe
  2⤵
  PID:4564
- C:\Windows\System\wYQohli.exe
  C:\Windows\System\wYQohli.exe
  2⤵
  PID:4648
- C:\Windows\System\OTEwrVl.exe
  C:\Windows\System\OTEwrVl.exe
  2⤵
  PID:4692
- C:\Windows\System\yzHWTJx.exe
  C:\Windows\System\yzHWTJx.exe
  2⤵
  PID:4708
- C:\Windows\System\TurxQPH.exe
  C:\Windows\System\TurxQPH.exe
  2⤵
  PID:4760
- C:\Windows\System\lpXpuhN.exe
  C:\Windows\System\lpXpuhN.exe
  2⤵
  PID:4820
- C:\Windows\System\uxyjNwt.exe
  C:\Windows\System\uxyjNwt.exe
  2⤵
  PID:4888
- C:\Windows\System\uaCVFTi.exe
  C:\Windows\System\uaCVFTi.exe
  2⤵
  PID:4840
- C:\Windows\System\LRrzpNk.exe
  C:\Windows\System\LRrzpNk.exe
  2⤵
  PID:4872
- C:\Windows\System\LWUmdKi.exe
  C:\Windows\System\LWUmdKi.exe
  2⤵
  PID:4984
- C:\Windows\System\wMNBZuR.exe
  C:\Windows\System\wMNBZuR.exe
  2⤵
  PID:4936
- C:\Windows\System\RNDnhTC.exe
  C:\Windows\System\RNDnhTC.exe
  2⤵
  PID:5052
- C:\Windows\System\QETwyvV.exe
  C:\Windows\System\QETwyvV.exe
  2⤵
  PID:5112
- C:\Windows\System\rnErnrA.exe
  C:\Windows\System\rnErnrA.exe
  2⤵
  PID:5004
- C:\Windows\System\IufPQKC.exe
  C:\Windows\System\IufPQKC.exe
  2⤵
  PID:3600
- C:\Windows\System\RRNTbxk.exe
  C:\Windows\System\RRNTbxk.exe
  2⤵
  PID:5096
- C:\Windows\System\ZitLCUj.exe
  C:\Windows\System\ZitLCUj.exe
  2⤵
  PID:5100
- C:\Windows\System\JivtBgw.exe
  C:\Windows\System\JivtBgw.exe
  2⤵
  PID:4116
- C:\Windows\System\ZIqLLCO.exe
  C:\Windows\System\ZIqLLCO.exe
  2⤵
  PID:3664
- C:\Windows\System\vEsMsUL.exe
  C:\Windows\System\vEsMsUL.exe
  2⤵
  PID:2740
- C:\Windows\System\qKojhfz.exe
  C:\Windows\System\qKojhfz.exe
  2⤵
  PID:4220
- C:\Windows\System\RhOdSdJ.exe
  C:\Windows\System\RhOdSdJ.exe
  2⤵
  PID:4240
- C:\Windows\System\TmUXjWo.exe
  C:\Windows\System\TmUXjWo.exe
  2⤵
  PID:4432
- C:\Windows\System\oQcnGex.exe
  C:\Windows\System\oQcnGex.exe
  2⤵
  PID:4544
- C:\Windows\System\kkqISyZ.exe
  C:\Windows\System\kkqISyZ.exe
  2⤵
  PID:4480
- C:\Windows\System\gFOMpVP.exe
  C:\Windows\System\gFOMpVP.exe
  2⤵
  PID:4624
- C:\Windows\System\aanitFg.exe
  C:\Windows\System\aanitFg.exe
  2⤵
  PID:4620
- C:\Windows\System\ORpqprJ.exe
  C:\Windows\System\ORpqprJ.exe
  2⤵
  PID:4460
- C:\Windows\System\KcFsMoQ.exe
  C:\Windows\System\KcFsMoQ.exe
  2⤵
  PID:4640
- C:\Windows\System\JKFpHGF.exe
  C:\Windows\System\JKFpHGF.exe
  2⤵
  PID:4720
- C:\Windows\System\MVHssrs.exe
  C:\Windows\System\MVHssrs.exe
  2⤵
  PID:4788
- C:\Windows\System\ztMazJl.exe
  C:\Windows\System\ztMazJl.exe
  2⤵
  PID:4860
- C:\Windows\System\okgcSbS.exe
  C:\Windows\System\okgcSbS.exe
  2⤵
  PID:4904
- C:\Windows\System\gMWRSrz.exe
  C:\Windows\System\gMWRSrz.exe
  2⤵
  PID:4920
- C:\Windows\System\XVIPNxp.exe
  C:\Windows\System\XVIPNxp.exe
  2⤵
  PID:4876
- C:\Windows\System\mIGpMdD.exe
  C:\Windows\System\mIGpMdD.exe
  2⤵
  PID:3696
- C:\Windows\System\JWMfglf.exe
  C:\Windows\System\JWMfglf.exe
  2⤵
  PID:1580
- C:\Windows\System\QXpsXPN.exe
  C:\Windows\System\QXpsXPN.exe
  2⤵
  PID:5068
- C:\Windows\System\XBHbbyF.exe
  C:\Windows\System\XBHbbyF.exe
  2⤵
  PID:4192
- C:\Windows\System\ZQpXTnY.exe
  C:\Windows\System\ZQpXTnY.exe
  2⤵
  PID:4396
- C:\Windows\System\ChUSurn.exe
  C:\Windows\System\ChUSurn.exe
  2⤵
  PID:4436
- C:\Windows\System\DicRWKi.exe
  C:\Windows\System\DicRWKi.exe
  2⤵
  PID:4416
- C:\Windows\System\OEcpXCn.exe
  C:\Windows\System\OEcpXCn.exe
  2⤵
  PID:4644
- C:\Windows\System\NnIaiSM.exe
  C:\Windows\System\NnIaiSM.exe
  2⤵
  PID:4704
- C:\Windows\System\Jdqrlfu.exe
  C:\Windows\System\Jdqrlfu.exe
  2⤵
  PID:4776
- C:\Windows\System\eGoRqUO.exe
  C:\Windows\System\eGoRqUO.exe
  2⤵
  PID:3416
- C:\Windows\System\VPZQAUl.exe
  C:\Windows\System\VPZQAUl.exe
  2⤵
  PID:4908
- C:\Windows\System\pxyoYTv.exe
  C:\Windows\System\pxyoYTv.exe
  2⤵
  PID:4360
- C:\Windows\System\zEimiJy.exe
  C:\Windows\System\zEimiJy.exe
  2⤵
  PID:4528
- C:\Windows\System\kbtBOfl.exe
  C:\Windows\System\kbtBOfl.exe
  2⤵
  PID:3992
- C:\Windows\System\WFHADgH.exe
  C:\Windows\System\WFHADgH.exe
  2⤵
  PID:4524
- C:\Windows\System\FAfAjbR.exe
  C:\Windows\System\FAfAjbR.exe
  2⤵
  PID:4332
- C:\Windows\System\LWJnRNk.exe
  C:\Windows\System\LWJnRNk.exe
  2⤵
  PID:5032
- C:\Windows\System\lOujOKy.exe
  C:\Windows\System\lOujOKy.exe
  2⤵
  PID:4740
- C:\Windows\System\hSQxblT.exe
  C:\Windows\System\hSQxblT.exe
  2⤵
  PID:5132
- C:\Windows\System\AsonOVi.exe
  C:\Windows\System\AsonOVi.exe
  2⤵
  PID:5152
- C:\Windows\System\PQQMetx.exe
  C:\Windows\System\PQQMetx.exe
  2⤵
  PID:5168
- C:\Windows\System\loObJUa.exe
  C:\Windows\System\loObJUa.exe
  2⤵
  PID:5184
- C:\Windows\System\bIcVftA.exe
  C:\Windows\System\bIcVftA.exe
  2⤵
  PID:5204
- C:\Windows\System\SutBABk.exe
  C:\Windows\System\SutBABk.exe
  2⤵
  PID:5220
- C:\Windows\System\TomklMj.exe
  C:\Windows\System\TomklMj.exe
  2⤵
  PID:5236
- C:\Windows\System\DgdpGzy.exe
  C:\Windows\System\DgdpGzy.exe
  2⤵
  PID:5252
- C:\Windows\System\bQhJfcj.exe
  C:\Windows\System\bQhJfcj.exe
  2⤵
  PID:5268
- C:\Windows\System\IiGEiYd.exe
  C:\Windows\System\IiGEiYd.exe
  2⤵
  PID:5284
- C:\Windows\System\rINNzrR.exe
  C:\Windows\System\rINNzrR.exe
  2⤵
  PID:5300
- C:\Windows\System\pOpziDn.exe
  C:\Windows\System\pOpziDn.exe
  2⤵
  PID:5316
- C:\Windows\System\qSePfLf.exe
  C:\Windows\System\qSePfLf.exe
  2⤵
  PID:5332
- C:\Windows\System\ynLXLIJ.exe
  C:\Windows\System\ynLXLIJ.exe
  2⤵
  PID:5348
- C:\Windows\System\QZmYkVD.exe
  C:\Windows\System\QZmYkVD.exe
  2⤵
  PID:5364
- C:\Windows\System\JDZgQSO.exe
  C:\Windows\System\JDZgQSO.exe
  2⤵
  PID:5384
- C:\Windows\System\jSggXfI.exe
  C:\Windows\System\jSggXfI.exe
  2⤵
  PID:5400
- C:\Windows\System\LIeGxBL.exe
  C:\Windows\System\LIeGxBL.exe
  2⤵
  PID:5416
- C:\Windows\System\dFeqXnP.exe
  C:\Windows\System\dFeqXnP.exe
  2⤵
  PID:5436
- C:\Windows\System\NLyTEHT.exe
  C:\Windows\System\NLyTEHT.exe
  2⤵
  PID:5456
- C:\Windows\System\nmZoezX.exe
  C:\Windows\System\nmZoezX.exe
  2⤵
  PID:5472
- C:\Windows\System\WkHffsm.exe
  C:\Windows\System\WkHffsm.exe
  2⤵
  PID:5492
- C:\Windows\System\lwBSHaN.exe
  C:\Windows\System\lwBSHaN.exe
  2⤵
  PID:5512
- C:\Windows\System\GlSztEd.exe
  C:\Windows\System\GlSztEd.exe
  2⤵
  PID:5548
- C:\Windows\System\HCEuPME.exe
  C:\Windows\System\HCEuPME.exe
  2⤵
  PID:5564
- C:\Windows\System\ZNWzLkg.exe
  C:\Windows\System\ZNWzLkg.exe
  2⤵
  PID:5584
- C:\Windows\System\puDkDHx.exe
  C:\Windows\System\puDkDHx.exe
  2⤵
  PID:5600
- C:\Windows\System\EcGcDXi.exe
  C:\Windows\System\EcGcDXi.exe
  2⤵
  PID:5616
- C:\Windows\System\fOsAhja.exe
  C:\Windows\System\fOsAhja.exe
  2⤵
  PID:5632
- C:\Windows\System\ZHRYEWY.exe
  C:\Windows\System\ZHRYEWY.exe
  2⤵
  PID:5660
- C:\Windows\System\TmeLDga.exe
  C:\Windows\System\TmeLDga.exe
  2⤵
  PID:5676
- C:\Windows\System\WnOAcAC.exe
  C:\Windows\System\WnOAcAC.exe
  2⤵
  PID:5704
- C:\Windows\System\kJGtYQD.exe
  C:\Windows\System\kJGtYQD.exe
  2⤵
  PID:5720
- C:\Windows\System\QFcGMwv.exe
  C:\Windows\System\QFcGMwv.exe
  2⤵
  PID:5740
- C:\Windows\System\eHRmgYf.exe
  C:\Windows\System\eHRmgYf.exe
  2⤵
  PID:5756
- C:\Windows\System\PyJwwKY.exe
  C:\Windows\System\PyJwwKY.exe
  2⤵
  PID:5776
- C:\Windows\System\BnjEoCd.exe
  C:\Windows\System\BnjEoCd.exe
  2⤵
  PID:5792
- C:\Windows\System\tkoBEVS.exe
  C:\Windows\System\tkoBEVS.exe
  2⤵
  PID:5808
- C:\Windows\System\WTuaiTx.exe
  C:\Windows\System\WTuaiTx.exe
  2⤵
  PID:5856
- C:\Windows\System\QokIDTp.exe
  C:\Windows\System\QokIDTp.exe
  2⤵
  PID:5872
- C:\Windows\System\BcaxvxO.exe
  C:\Windows\System\BcaxvxO.exe
  2⤵
  PID:5888
- C:\Windows\System\GZtWxVU.exe
  C:\Windows\System\GZtWxVU.exe
  2⤵
  PID:5932
- C:\Windows\System\jjVrVVp.exe
  C:\Windows\System\jjVrVVp.exe
  2⤵
  PID:5948
- C:\Windows\System\YFjqzRh.exe
  C:\Windows\System\YFjqzRh.exe
  2⤵
  PID:5964
- C:\Windows\System\XljcWQw.exe
  C:\Windows\System\XljcWQw.exe
  2⤵
  PID:5980
- C:\Windows\System\bQQuthS.exe
  C:\Windows\System\bQQuthS.exe
  2⤵
  PID:6000
- C:\Windows\System\rLommdG.exe
  C:\Windows\System\rLommdG.exe
  2⤵
  PID:6020
- C:\Windows\System\QZHttkY.exe
  C:\Windows\System\QZHttkY.exe
  2⤵
  PID:6040
- C:\Windows\System\jVNFhRZ.exe
  C:\Windows\System\jVNFhRZ.exe
  2⤵
  PID:6056
- C:\Windows\System\rOinAWK.exe
  C:\Windows\System\rOinAWK.exe
  2⤵
  PID:6072
- C:\Windows\System\iKhyMQC.exe
  C:\Windows\System\iKhyMQC.exe
  2⤵
  PID:6088
- C:\Windows\System\WwfeXcy.exe
  C:\Windows\System\WwfeXcy.exe
  2⤵
  PID:6104
- C:\Windows\System\TvCgqet.exe
  C:\Windows\System\TvCgqet.exe
  2⤵
  PID:6120
- C:\Windows\System\tQIGDfV.exe
  C:\Windows\System\tQIGDfV.exe
  2⤵
  PID:6136
- C:\Windows\System\xDAGPWr.exe
  C:\Windows\System\xDAGPWr.exe
  2⤵
  PID:240
- C:\Windows\System\zpCqDIH.exe
  C:\Windows\System\zpCqDIH.exe
  2⤵
  PID:5192
- C:\Windows\System\KrwyZAx.exe
  C:\Windows\System\KrwyZAx.exe
  2⤵
  PID:5140
- C:\Windows\System\LbJkfxb.exe
  C:\Windows\System\LbJkfxb.exe
  2⤵
  PID:5180
- C:\Windows\System\rrMyIAG.exe
  C:\Windows\System\rrMyIAG.exe
  2⤵
  PID:5264
- C:\Windows\System\qxslkCs.exe
  C:\Windows\System\qxslkCs.exe
  2⤵
  PID:5324
- C:\Windows\System\NDpvmLj.exe
  C:\Windows\System\NDpvmLj.exe
  2⤵
  PID:5248
- C:\Windows\System\EEuHtzM.exe
  C:\Windows\System\EEuHtzM.exe
  2⤵
  PID:5344
- C:\Windows\System\xXJaxzd.exe
  C:\Windows\System\xXJaxzd.exe
  2⤵
  PID:5424
- C:\Windows\System\WBydEVw.exe
  C:\Windows\System\WBydEVw.exe
  2⤵
  PID:5468
- C:\Windows\System\dQSQxTy.exe
  C:\Windows\System\dQSQxTy.exe
  2⤵
  PID:5380
- C:\Windows\System\ohwkYbO.exe
  C:\Windows\System\ohwkYbO.exe
  2⤵
  PID:5448
- C:\Windows\System\QtZPbia.exe
  C:\Windows\System\QtZPbia.exe
  2⤵
  PID:5488
- C:\Windows\System\axSDSix.exe
  C:\Windows\System\axSDSix.exe
  2⤵
  PID:5532
- C:\Windows\System\YrTjlFV.exe
  C:\Windows\System\YrTjlFV.exe
  2⤵
  PID:5560
- C:\Windows\System\pbslajW.exe
  C:\Windows\System\pbslajW.exe
  2⤵
  PID:5612
- C:\Windows\System\Kynrfvk.exe
  C:\Windows\System\Kynrfvk.exe
  2⤵
  PID:5652
- C:\Windows\System\kzTFxja.exe
  C:\Windows\System\kzTFxja.exe
  2⤵
  PID:5656
- C:\Windows\System\pQJycwb.exe
  C:\Windows\System\pQJycwb.exe
  2⤵
  PID:5700
- C:\Windows\System\dQJPjLI.exe
  C:\Windows\System\dQJPjLI.exe
  2⤵
  PID:5668
- C:\Windows\System\ZHXfPhS.exe
  C:\Windows\System\ZHXfPhS.exe
  2⤵
  PID:5752
- C:\Windows\System\sqENnFR.exe
  C:\Windows\System\sqENnFR.exe
  2⤵
  PID:5804
- C:\Windows\System\qdGWdbv.exe
  C:\Windows\System\qdGWdbv.exe
  2⤵
  PID:5820
- C:\Windows\System\xIqbnqG.exe
  C:\Windows\System\xIqbnqG.exe
  2⤵
  PID:5536
- C:\Windows\System\bGAVIIB.exe
  C:\Windows\System\bGAVIIB.exe
  2⤵
  PID:5828
- C:\Windows\System\hccgDJu.exe
  C:\Windows\System\hccgDJu.exe
  2⤵
  PID:5884
- C:\Windows\System\KtVbGpt.exe
  C:\Windows\System\KtVbGpt.exe
  2⤵
  PID:5904
- C:\Windows\System\MesInVj.exe
  C:\Windows\System\MesInVj.exe
  2⤵
  PID:5920
- C:\Windows\System\YYxeEih.exe
  C:\Windows\System\YYxeEih.exe
  2⤵
  PID:5988
- C:\Windows\System\ddWErjh.exe
  C:\Windows\System\ddWErjh.exe
  2⤵
  PID:5940
- C:\Windows\System\eHePZlA.exe
  C:\Windows\System\eHePZlA.exe
  2⤵
  PID:6048
- C:\Windows\System\pkbhwZv.exe
  C:\Windows\System\pkbhwZv.exe
  2⤵
  PID:5972
- C:\Windows\System\QJffEMC.exe
  C:\Windows\System\QJffEMC.exe
  2⤵
  PID:6080
- C:\Windows\System\dWPptiN.exe
  C:\Windows\System\dWPptiN.exe
  2⤵
  PID:6116
- C:\Windows\System\ZnkoCyC.exe
  C:\Windows\System\ZnkoCyC.exe
  2⤵
  PID:5144
- C:\Windows\System\UQzQUqM.exe
  C:\Windows\System\UQzQUqM.exe
  2⤵
  PID:5280
- C:\Windows\System\FtuufCN.exe
  C:\Windows\System\FtuufCN.exe
  2⤵
  PID:5020
- C:\Windows\System\qxxlpdG.exe
  C:\Windows\System\qxxlpdG.exe
  2⤵
  PID:5312
- C:\Windows\System\GszuBbA.exe
  C:\Windows\System\GszuBbA.exe
  2⤵
  PID:5432
- C:\Windows\System\qEaebwl.exe
  C:\Windows\System\qEaebwl.exe
  2⤵
  PID:5444
- C:\Windows\System\xZLVhwm.exe
  C:\Windows\System\xZLVhwm.exe
  2⤵
  PID:5576
- C:\Windows\System\jyCwnvq.exe
  C:\Windows\System\jyCwnvq.exe
  2⤵
  PID:5596
- C:\Windows\System\jKcayND.exe
  C:\Windows\System\jKcayND.exe
  2⤵
  PID:5824
- C:\Windows\System\sqQiTrV.exe
  C:\Windows\System\sqQiTrV.exe
  2⤵
  PID:5900
- C:\Windows\System\paQBboM.exe
  C:\Windows\System\paQBboM.exe
  2⤵
  PID:6036
- C:\Windows\System\kvAHjey.exe
  C:\Windows\System\kvAHjey.exe
  2⤵
  PID:5504
- C:\Windows\System\VoIeNxl.exe
  C:\Windows\System\VoIeNxl.exe
  2⤵
  PID:5836
- C:\Windows\System\PAXGKHB.exe
  C:\Windows\System\PAXGKHB.exe
  2⤵
  PID:6128
- C:\Windows\System\vIffZDc.exe
  C:\Windows\System\vIffZDc.exe
  2⤵
  PID:5912
- C:\Windows\System\idBJRCJ.exe
  C:\Windows\System\idBJRCJ.exe
  2⤵
  PID:5628
- C:\Windows\System\sdYyKLu.exe
  C:\Windows\System\sdYyKLu.exe
  2⤵
  PID:5768
- C:\Windows\System\dkaBpuL.exe
  C:\Windows\System\dkaBpuL.exe
  2⤵
  PID:5296
- C:\Windows\System\OZnTisY.exe
  C:\Windows\System\OZnTisY.exe
  2⤵
  PID:5164
- C:\Windows\System\TomVNrA.exe
  C:\Windows\System\TomVNrA.exe
  2⤵
  PID:5308
- C:\Windows\System\PzrZhhD.exe
  C:\Windows\System\PzrZhhD.exe
  2⤵
  PID:5232
- C:\Windows\System\DjNZDhe.exe
  C:\Windows\System\DjNZDhe.exe
  2⤵
  PID:5396
- C:\Windows\System\vgMeUJf.exe
  C:\Windows\System\vgMeUJf.exe
  2⤵
  PID:5880
- C:\Windows\System\MuPgyDS.exe
  C:\Windows\System\MuPgyDS.exe
  2⤵
  PID:5976
- C:\Windows\System\gaVqcji.exe
  C:\Windows\System\gaVqcji.exe
  2⤵
  PID:5728
- C:\Windows\System\AQcTbXE.exe
  C:\Windows\System\AQcTbXE.exe
  2⤵
  PID:5916
- C:\Windows\System\XOPmoaM.exe
  C:\Windows\System\XOPmoaM.exe
  2⤵
  PID:5712
- C:\Windows\System\CTBdcDO.exe
  C:\Windows\System\CTBdcDO.exe
  2⤵
  PID:5340
- C:\Windows\System\kKmUgjG.exe
  C:\Windows\System\kKmUgjG.exe
  2⤵
  PID:5392
- C:\Windows\System\PLoGdHi.exe
  C:\Windows\System\PLoGdHi.exe
  2⤵
  PID:5544
- C:\Windows\System\rXGRYYw.exe
  C:\Windows\System\rXGRYYw.exe
  2⤵
  PID:6012
- C:\Windows\System\UgVDiZT.exe
  C:\Windows\System\UgVDiZT.exe
  2⤵
  PID:6156
- C:\Windows\System\VpKIGvD.exe
  C:\Windows\System\VpKIGvD.exe
  2⤵
  PID:6176
- C:\Windows\System\sMhRzSS.exe
  C:\Windows\System\sMhRzSS.exe
  2⤵
  PID:6192
- C:\Windows\System\mCoatNw.exe
  C:\Windows\System\mCoatNw.exe
  2⤵
  PID:6208
- C:\Windows\System\TgnIfpA.exe
  C:\Windows\System\TgnIfpA.exe
  2⤵
  PID:6224
- C:\Windows\System\QFtvejj.exe
  C:\Windows\System\QFtvejj.exe
  2⤵
  PID:6240
- C:\Windows\System\qlZdDDo.exe
  C:\Windows\System\qlZdDDo.exe
  2⤵
  PID:6256
- C:\Windows\System\kncnlNv.exe
  C:\Windows\System\kncnlNv.exe
  2⤵
  PID:6272
- C:\Windows\System\bnjfYum.exe
  C:\Windows\System\bnjfYum.exe
  2⤵
  PID:6292
- C:\Windows\System\LwEzDsT.exe
  C:\Windows\System\LwEzDsT.exe
  2⤵
  PID:6308
- C:\Windows\System\tqdHYoC.exe
  C:\Windows\System\tqdHYoC.exe
  2⤵
  PID:6324
- C:\Windows\System\YmTmVhn.exe
  C:\Windows\System\YmTmVhn.exe
  2⤵
  PID:6340
- C:\Windows\System\AAiFvgX.exe
  C:\Windows\System\AAiFvgX.exe
  2⤵
  PID:6360
- C:\Windows\System\uubqRGo.exe
  C:\Windows\System\uubqRGo.exe
  2⤵
  PID:6376
- C:\Windows\System\BKecBll.exe
  C:\Windows\System\BKecBll.exe
  2⤵
  PID:6392
- C:\Windows\System\imgVKyb.exe
  C:\Windows\System\imgVKyb.exe
  2⤵
  PID:6408
- C:\Windows\System\ESSiDpR.exe
  C:\Windows\System\ESSiDpR.exe
  2⤵
  PID:6424
- C:\Windows\System\BSVClDF.exe
  C:\Windows\System\BSVClDF.exe
  2⤵
  PID:6440
- C:\Windows\System\PldcODl.exe
  C:\Windows\System\PldcODl.exe
  2⤵
  PID:6456
- C:\Windows\System\wxtpJRO.exe
  C:\Windows\System\wxtpJRO.exe
  2⤵
  PID:6472
- C:\Windows\System\pUvqMex.exe
  C:\Windows\System\pUvqMex.exe
  2⤵
  PID:6488
- C:\Windows\System\eAjetNL.exe
  C:\Windows\System\eAjetNL.exe
  2⤵
  PID:6508
- C:\Windows\System\KnwtPoR.exe
  C:\Windows\System\KnwtPoR.exe
  2⤵
  PID:6524
- C:\Windows\System\MpUtMyE.exe
  C:\Windows\System\MpUtMyE.exe
  2⤵
  PID:6540
- C:\Windows\System\JtooVxe.exe
  C:\Windows\System\JtooVxe.exe
  2⤵
  PID:6556
- C:\Windows\System\Wlthwzi.exe
  C:\Windows\System\Wlthwzi.exe
  2⤵
  PID:6572
- C:\Windows\System\lYiPvbO.exe
  C:\Windows\System\lYiPvbO.exe
  2⤵
  PID:6588
- C:\Windows\System\Hmqmsgu.exe
  C:\Windows\System\Hmqmsgu.exe
  2⤵
  PID:6604
- C:\Windows\System\mZueSDl.exe
  C:\Windows\System\mZueSDl.exe
  2⤵
  PID:6624
- C:\Windows\System\JMZbtpd.exe
  C:\Windows\System\JMZbtpd.exe
  2⤵
  PID:6640
- C:\Windows\System\vBGpyRa.exe
  C:\Windows\System\vBGpyRa.exe
  2⤵
  PID:6656
- C:\Windows\System\VfYTyes.exe
  C:\Windows\System\VfYTyes.exe
  2⤵
  PID:6672
- C:\Windows\System\UfICDSh.exe
  C:\Windows\System\UfICDSh.exe
  2⤵
  PID:6688
- C:\Windows\System\tOgtNTn.exe
  C:\Windows\System\tOgtNTn.exe
  2⤵
  PID:6704
- C:\Windows\System\wfCVwNb.exe
  C:\Windows\System\wfCVwNb.exe
  2⤵
  PID:6720
- C:\Windows\System\okycxYF.exe
  C:\Windows\System\okycxYF.exe
  2⤵
  PID:6736
- C:\Windows\System\iPCCcoL.exe
  C:\Windows\System\iPCCcoL.exe
  2⤵
  PID:6752
- C:\Windows\System\hCrkLAS.exe
  C:\Windows\System\hCrkLAS.exe
  2⤵
  PID:6768
- C:\Windows\System\kjKEfek.exe
  C:\Windows\System\kjKEfek.exe
  2⤵
  PID:6784
- C:\Windows\System\eVsKvkb.exe
  C:\Windows\System\eVsKvkb.exe
  2⤵
  PID:6800
- C:\Windows\System\koItQZt.exe
  C:\Windows\System\koItQZt.exe
  2⤵
  PID:6820
- C:\Windows\System\tBNKEGc.exe
  C:\Windows\System\tBNKEGc.exe
  2⤵
  PID:6840
- C:\Windows\System\NbWblEu.exe
  C:\Windows\System\NbWblEu.exe
  2⤵
  PID:6856
- C:\Windows\System\nohhJlw.exe
  C:\Windows\System\nohhJlw.exe
  2⤵
  PID:6872
- C:\Windows\System\EDdJKyq.exe
  C:\Windows\System\EDdJKyq.exe
  2⤵
  PID:6892
- C:\Windows\System\slHFFNs.exe
  C:\Windows\System\slHFFNs.exe
  2⤵
  PID:6908
- C:\Windows\System\rmZPRAU.exe
  C:\Windows\System\rmZPRAU.exe
  2⤵
  PID:6924
- C:\Windows\System\zTaaTCf.exe
  C:\Windows\System\zTaaTCf.exe
  2⤵
  PID:6940
- C:\Windows\System\FFmiFiP.exe
  C:\Windows\System\FFmiFiP.exe
  2⤵
  PID:6956
- C:\Windows\System\RvhRdsW.exe
  C:\Windows\System\RvhRdsW.exe
  2⤵
  PID:6972
- C:\Windows\System\lXNGXKc.exe
  C:\Windows\System\lXNGXKc.exe
  2⤵
  PID:6988
- C:\Windows\System\BuyIdNC.exe
  C:\Windows\System\BuyIdNC.exe
  2⤵
  PID:7004
- C:\Windows\System\HVlLSog.exe
  C:\Windows\System\HVlLSog.exe
  2⤵
  PID:7028
- C:\Windows\System\nChAqTo.exe
  C:\Windows\System\nChAqTo.exe
  2⤵
  PID:7044
- C:\Windows\System\RqAfZpf.exe
  C:\Windows\System\RqAfZpf.exe
  2⤵
  PID:7060
- C:\Windows\System\GoKCCRk.exe
  C:\Windows\System\GoKCCRk.exe
  2⤵
  PID:7076
- C:\Windows\System\YvoKRMz.exe
  C:\Windows\System\YvoKRMz.exe
  2⤵
  PID:7092
- C:\Windows\System\Ytltjtp.exe
  C:\Windows\System\Ytltjtp.exe
  2⤵
  PID:7108
- C:\Windows\System\dyWYslc.exe
  C:\Windows\System\dyWYslc.exe
  2⤵
  PID:7124
- C:\Windows\System\XrGfCCg.exe
  C:\Windows\System\XrGfCCg.exe
  2⤵
  PID:7140
- C:\Windows\System\ZsSrFgs.exe
  C:\Windows\System\ZsSrFgs.exe
  2⤵
  PID:7160
- C:\Windows\System\WcXwsGm.exe
  C:\Windows\System\WcXwsGm.exe
  2⤵
  PID:4804
- C:\Windows\System\DjyffXZ.exe
  C:\Windows\System\DjyffXZ.exe
  2⤵
  PID:5124
- C:\Windows\System\LpGOmuz.exe
  C:\Windows\System\LpGOmuz.exe
  2⤵
  PID:5692
- C:\Windows\System\dXoKbwS.exe
  C:\Windows\System\dXoKbwS.exe
  2⤵
  PID:5696
- C:\Windows\System\ZhHLnPa.exe
  C:\Windows\System\ZhHLnPa.exe
  2⤵
  PID:6168
- C:\Windows\System\GpSTObN.exe
  C:\Windows\System\GpSTObN.exe
  2⤵
  PID:6220
- C:\Windows\System\mhsSDfx.exe
  C:\Windows\System\mhsSDfx.exe
  2⤵
  PID:6284
- C:\Windows\System\qREyZzl.exe
  C:\Windows\System\qREyZzl.exe
  2⤵
  PID:6316
- C:\Windows\System\PapAlBm.exe
  C:\Windows\System\PapAlBm.exe
  2⤵
  PID:6232
- C:\Windows\System\FpviJux.exe
  C:\Windows\System\FpviJux.exe
  2⤵
  PID:6300
- C:\Windows\System\abmDGrL.exe
  C:\Windows\System\abmDGrL.exe
  2⤵
  PID:6384
- C:\Windows\System\UwNqHQj.exe
  C:\Windows\System\UwNqHQj.exe
  2⤵
  PID:6448
- C:\Windows\System\YdgPtxw.exe
  C:\Windows\System\YdgPtxw.exe
  2⤵
  PID:6468
- C:\Windows\System\dXTWbhI.exe
  C:\Windows\System\dXTWbhI.exe
  2⤵
  PID:6464
- C:\Windows\System\FiDSWxi.exe
  C:\Windows\System\FiDSWxi.exe
  2⤵
  PID:6516
- C:\Windows\System\cchCsGB.exe
  C:\Windows\System\cchCsGB.exe
  2⤵
  PID:6548
- C:\Windows\System\bZspsSv.exe
  C:\Windows\System\bZspsSv.exe
  2⤵
  PID:6612
- C:\Windows\System\QHzSUiZ.exe
  C:\Windows\System\QHzSUiZ.exe
  2⤵
  PID:6536
- C:\Windows\System\RIDOAZL.exe
  C:\Windows\System\RIDOAZL.exe
  2⤵
  PID:6596
- C:\Windows\System\ZgmcCwD.exe
  C:\Windows\System\ZgmcCwD.exe
  2⤵
  PID:6680
- C:\Windows\System\EpcoOCA.exe
  C:\Windows\System\EpcoOCA.exe
  2⤵
  PID:6712
- C:\Windows\System\guPQzei.exe
  C:\Windows\System\guPQzei.exe
  2⤵
  PID:6728
- C:\Windows\System\DulENbm.exe
  C:\Windows\System\DulENbm.exe
  2⤵
  PID:6828
- C:\Windows\System\hHlFWvl.exe
  C:\Windows\System\hHlFWvl.exe
  2⤵
  PID:6776
- C:\Windows\System\emVfsMK.exe
  C:\Windows\System\emVfsMK.exe
  2⤵
  PID:6904
- C:\Windows\System\Jsaenlc.exe
  C:\Windows\System\Jsaenlc.exe
  2⤵
  PID:6996
- C:\Windows\System\QhkYYDj.exe
  C:\Windows\System\QhkYYDj.exe
  2⤵
  PID:6968
- C:\Windows\System\hCuuZuY.exe
  C:\Windows\System\hCuuZuY.exe
  2⤵
  PID:6836
- C:\Windows\System\dmhunVh.exe
  C:\Windows\System\dmhunVh.exe
  2⤵
  PID:6884
- C:\Windows\System\zuBCJuc.exe
  C:\Windows\System\zuBCJuc.exe
  2⤵
  PID:6948
- C:\Windows\System\RgQrtKr.exe
  C:\Windows\System\RgQrtKr.exe
  2⤵
  PID:7016
- C:\Windows\System\GDYERDB.exe
  C:\Windows\System\GDYERDB.exe
  2⤵
  PID:7056
- C:\Windows\System\lYMTEzs.exe
  C:\Windows\System\lYMTEzs.exe
  2⤵
  PID:7040
- C:\Windows\System\ScsMQNp.exe
  C:\Windows\System\ScsMQNp.exe
  2⤵
  PID:7104
- C:\Windows\System\xLUxvYQ.exe
  C:\Windows\System\xLUxvYQ.exe
  2⤵
  PID:7156
- C:\Windows\System\vvaFrfg.exe
  C:\Windows\System\vvaFrfg.exe
  2⤵
  PID:6148
- C:\Windows\System\bfOAwNA.exe
  C:\Windows\System\bfOAwNA.exe
  2⤵
  PID:6100
- C:\Windows\System\jJqnJBg.exe
  C:\Windows\System\jJqnJBg.exe
  2⤵
  PID:5648
- C:\Windows\System\weLnwrk.exe
  C:\Windows\System\weLnwrk.exe
  2⤵
  PID:6252
- C:\Windows\System\wqLZeWp.exe
  C:\Windows\System\wqLZeWp.exe
  2⤵
  PID:6204
- C:\Windows\System\knsvPSK.exe
  C:\Windows\System\knsvPSK.exe
  2⤵
  PID:6420
- C:\Windows\System\IPqnIbs.exe
  C:\Windows\System\IPqnIbs.exe
  2⤵
  PID:6500
- C:\Windows\System\lyYRVjF.exe
  C:\Windows\System\lyYRVjF.exe
  2⤵
  PID:6480
- C:\Windows\System\RxqGEUf.exe
  C:\Windows\System\RxqGEUf.exe
  2⤵
  PID:6368
- C:\Windows\System\oBFAGvm.exe
  C:\Windows\System\oBFAGvm.exe
  2⤵
  PID:6652
- C:\Windows\System\dzcgIrp.exe
  C:\Windows\System\dzcgIrp.exe
  2⤵
  PID:6936
- C:\Windows\System\iqfRZZz.exe
  C:\Windows\System\iqfRZZz.exe
  2⤵
  PID:6664
- C:\Windows\System\FUqRpKP.exe
  C:\Windows\System\FUqRpKP.exe
  2⤵
  PID:6916
- C:\Windows\System\TdiBere.exe
  C:\Windows\System\TdiBere.exe
  2⤵
  PID:6900
- C:\Windows\System\VdWSYNx.exe
  C:\Windows\System\VdWSYNx.exe
  2⤵
  PID:6780
- C:\Windows\System\dkBgCFE.exe
  C:\Windows\System\dkBgCFE.exe
  2⤵
  PID:7088
- C:\Windows\System\wmBLQQg.exe
  C:\Windows\System\wmBLQQg.exe
  2⤵
  PID:7148
- C:\Windows\System\xjVvYxD.exe
  C:\Windows\System\xjVvYxD.exe
  2⤵
  PID:5960
- C:\Windows\System\dparvrd.exe
  C:\Windows\System\dparvrd.exe
  2⤵
  PID:6648
- C:\Windows\System\gcbpuzj.exe
  C:\Windows\System\gcbpuzj.exe
  2⤵
  PID:6848
- C:\Windows\System\quWMchN.exe
  C:\Windows\System\quWMchN.exe
  2⤵
  PID:6984
- C:\Windows\System\ncDvOTc.exe
  C:\Windows\System\ncDvOTc.exe
  2⤵
  PID:6320
- C:\Windows\System\VwbTzwN.exe
  C:\Windows\System\VwbTzwN.exe
  2⤵
  PID:6484
- C:\Windows\System\Ghswhka.exe
  C:\Windows\System\Ghswhka.exe
  2⤵
  PID:6816
- C:\Windows\System\gPemizD.exe
  C:\Windows\System\gPemizD.exe
  2⤵
  PID:7152
- C:\Windows\System\KhAfqDM.exe
  C:\Windows\System\KhAfqDM.exe
  2⤵
  PID:6868
- C:\Windows\System\fPiVXdE.exe
  C:\Windows\System\fPiVXdE.exe
  2⤵
  PID:6792
- C:\Windows\System\AvjMTUA.exe
  C:\Windows\System\AvjMTUA.exe
  2⤵
  PID:7184
- C:\Windows\System\GuuIyqb.exe
  C:\Windows\System\GuuIyqb.exe
  2⤵
  PID:7204
- C:\Windows\System\DzItWHp.exe
  C:\Windows\System\DzItWHp.exe
  2⤵
  PID:7220
- C:\Windows\System\uJkMxvt.exe
  C:\Windows\System\uJkMxvt.exe
  2⤵
  PID:7240
- C:\Windows\System\OTehLIz.exe
  C:\Windows\System\OTehLIz.exe
  2⤵
  PID:7256
- C:\Windows\System\CJxcScB.exe
  C:\Windows\System\CJxcScB.exe
  2⤵
  PID:7276
- C:\Windows\System\ofzGwRZ.exe
  C:\Windows\System\ofzGwRZ.exe
  2⤵
  PID:7292
- C:\Windows\System\YJpdWTy.exe
  C:\Windows\System\YJpdWTy.exe
  2⤵
  PID:7312
- C:\Windows\System\zjmzIHq.exe
  C:\Windows\System\zjmzIHq.exe
  2⤵
  PID:7328
- C:\Windows\System\HXkigMA.exe
  C:\Windows\System\HXkigMA.exe
  2⤵
  PID:7352
- C:\Windows\System\uzLpmYB.exe
  C:\Windows\System\uzLpmYB.exe
  2⤵
  PID:7368
- C:\Windows\System\PaDJHNY.exe
  C:\Windows\System\PaDJHNY.exe
  2⤵
  PID:7384
- C:\Windows\System\OOkWuEg.exe
  C:\Windows\System\OOkWuEg.exe
  2⤵
  PID:7408
- C:\Windows\System\uyEazED.exe
  C:\Windows\System\uyEazED.exe
  2⤵
  PID:7432
- C:\Windows\System\qgwDnCL.exe
  C:\Windows\System\qgwDnCL.exe
  2⤵
  PID:7468
- C:\Windows\System\lHuBklS.exe
  C:\Windows\System\lHuBklS.exe
  2⤵
  PID:7484
- C:\Windows\System\uevTpPt.exe
  C:\Windows\System\uevTpPt.exe
  2⤵
  PID:7500
- C:\Windows\System\XaDRJsk.exe
  C:\Windows\System\XaDRJsk.exe
  2⤵
  PID:7516
- C:\Windows\System\wzSNsLd.exe
  C:\Windows\System\wzSNsLd.exe
  2⤵
  PID:7540
- C:\Windows\System\FJEyKGL.exe
  C:\Windows\System\FJEyKGL.exe
  2⤵
  PID:7564
- C:\Windows\System\SDdRLAc.exe
  C:\Windows\System\SDdRLAc.exe
  2⤵
  PID:7580
- C:\Windows\System\XWHVIhQ.exe
  C:\Windows\System\XWHVIhQ.exe
  2⤵
  PID:7616
- C:\Windows\System\sqNpTdQ.exe
  C:\Windows\System\sqNpTdQ.exe
  2⤵
  PID:7632
- C:\Windows\System\miyyupX.exe
  C:\Windows\System\miyyupX.exe
  2⤵
  PID:7648
- C:\Windows\System\inmXMSU.exe
  C:\Windows\System\inmXMSU.exe
  2⤵
  PID:7664
- C:\Windows\System\KQvHYgX.exe
  C:\Windows\System\KQvHYgX.exe
  2⤵
  PID:7684
- C:\Windows\System\ykQoIJE.exe
  C:\Windows\System\ykQoIJE.exe
  2⤵
  PID:7700
- C:\Windows\System\qiieLOF.exe
  C:\Windows\System\qiieLOF.exe
  2⤵
  PID:7716
- C:\Windows\System\JTPFtYk.exe
  C:\Windows\System\JTPFtYk.exe
  2⤵
  PID:7732
- C:\Windows\System\xecjbiC.exe
  C:\Windows\System\xecjbiC.exe
  2⤵
  PID:7748
- C:\Windows\System\eevNGXJ.exe
  C:\Windows\System\eevNGXJ.exe
  2⤵
  PID:7764
- C:\Windows\System\cCWBteB.exe
  C:\Windows\System\cCWBteB.exe
  2⤵
  PID:7792
- C:\Windows\System\wyDBEXS.exe
  C:\Windows\System\wyDBEXS.exe
  2⤵
  PID:7808
- C:\Windows\System\BCiEAir.exe
  C:\Windows\System\BCiEAir.exe
  2⤵
  PID:7828
- C:\Windows\System\okYlJuH.exe
  C:\Windows\System\okYlJuH.exe
  2⤵
  PID:7848
- C:\Windows\System\UBNOSJa.exe
  C:\Windows\System\UBNOSJa.exe
  2⤵
  PID:7872
- C:\Windows\System\yRLCdCM.exe
  C:\Windows\System\yRLCdCM.exe
  2⤵
  PID:7892
- C:\Windows\System\SzaUJrd.exe
  C:\Windows\System\SzaUJrd.exe
  2⤵
  PID:7948
- C:\Windows\System\rlEmXxO.exe
  C:\Windows\System\rlEmXxO.exe
  2⤵
  PID:7964
- C:\Windows\System\XkzOpjR.exe
  C:\Windows\System\XkzOpjR.exe
  2⤵
  PID:7980
- C:\Windows\System\BQlHGIe.exe
  C:\Windows\System\BQlHGIe.exe
  2⤵
  PID:7996
- C:\Windows\System\oDzOFTX.exe
  C:\Windows\System\oDzOFTX.exe
  2⤵
  PID:8012
- C:\Windows\System\ofaOhjq.exe
  C:\Windows\System\ofaOhjq.exe
  2⤵
  PID:8028
- C:\Windows\System\zdwagQh.exe
  C:\Windows\System\zdwagQh.exe
  2⤵
  PID:8048
- C:\Windows\System\yKyfImM.exe
  C:\Windows\System\yKyfImM.exe
  2⤵
  PID:8064
- C:\Windows\System\TqOQBVF.exe
  C:\Windows\System\TqOQBVF.exe
  2⤵
  PID:8080
- C:\Windows\System\qDUVscF.exe
  C:\Windows\System\qDUVscF.exe
  2⤵
  PID:8096
- C:\Windows\System\GjciKjw.exe
  C:\Windows\System\GjciKjw.exe
  2⤵
  PID:8112
- C:\Windows\System\tgzGXtJ.exe
  C:\Windows\System\tgzGXtJ.exe
  2⤵
  PID:8128
- C:\Windows\System\tuxjJVF.exe
  C:\Windows\System\tuxjJVF.exe
  2⤵
  PID:8144
- C:\Windows\System\vFbtinT.exe
  C:\Windows\System\vFbtinT.exe
  2⤵
  PID:8160
- C:\Windows\System\FrCPTCr.exe
  C:\Windows\System\FrCPTCr.exe
  2⤵
  PID:8176
- C:\Windows\System\tODRhHx.exe
  C:\Windows\System\tODRhHx.exe
  2⤵
  PID:6164
- C:\Windows\System\kmcSxop.exe
  C:\Windows\System\kmcSxop.exe
  2⤵
  PID:7192
- C:\Windows\System\axwDDSe.exe
  C:\Windows\System\axwDDSe.exe
  2⤵
  PID:7268
- C:\Windows\System\FLnFtlU.exe
  C:\Windows\System\FLnFtlU.exe
  2⤵
  PID:7308
- C:\Windows\System\PVAamAy.exe
  C:\Windows\System\PVAamAy.exe
  2⤵
  PID:7348
- C:\Windows\System\mKrPdJX.exe
  C:\Windows\System\mKrPdJX.exe
  2⤵
  PID:7420
- C:\Windows\System\vBHintk.exe
  C:\Windows\System\vBHintk.exe
  2⤵
  PID:6580
- C:\Windows\System\LPiaCXg.exe
  C:\Windows\System\LPiaCXg.exe
  2⤵
  PID:6748
- C:\Windows\System\dzcgDfi.exe
  C:\Windows\System\dzcgDfi.exe
  2⤵
  PID:6812
- C:\Windows\System\pLNGlXS.exe
  C:\Windows\System\pLNGlXS.exe
  2⤵
  PID:6864
- C:\Windows\System\iICrNBt.exe
  C:\Windows\System\iICrNBt.exe
  2⤵
  PID:7216
- C:\Windows\System\MUkvYOv.exe
  C:\Windows\System\MUkvYOv.exe
  2⤵
  PID:7288
- C:\Windows\System\prgWdbf.exe
  C:\Windows\System\prgWdbf.exe
  2⤵
  PID:7364
- C:\Windows\System\JyBjUXn.exe
  C:\Windows\System\JyBjUXn.exe
  2⤵
  PID:7400
- C:\Windows\System\psXquxT.exe
  C:\Windows\System\psXquxT.exe
  2⤵
  PID:7496
- C:\Windows\System\DwtPzrK.exe
  C:\Windows\System\DwtPzrK.exe
  2⤵
  PID:7452
- C:\Windows\System\OQNQBho.exe
  C:\Windows\System\OQNQBho.exe
  2⤵
  PID:7480
- C:\Windows\System\XPrsnae.exe
  C:\Windows\System\XPrsnae.exe
  2⤵
  PID:7552
- C:\Windows\System\eumjZQu.exe
  C:\Windows\System\eumjZQu.exe
  2⤵
  PID:7592
- C:\Windows\System\RNsQBcO.exe
  C:\Windows\System\RNsQBcO.exe
  2⤵
  PID:7640
- C:\Windows\System\DFhVLFi.exe
  C:\Windows\System\DFhVLFi.exe
  2⤵
  PID:7708
- C:\Windows\System\ibsBeiT.exe
  C:\Windows\System\ibsBeiT.exe
  2⤵
  PID:7624
- C:\Windows\System\BwOTdRy.exe
  C:\Windows\System\BwOTdRy.exe
  2⤵
  PID:7696
- C:\Windows\System\GcXDRsv.exe
  C:\Windows\System\GcXDRsv.exe
  2⤵
  PID:7836
- C:\Windows\System\pmYTfBS.exe
  C:\Windows\System\pmYTfBS.exe
  2⤵
  PID:7760
- C:\Windows\System\LvFeCqC.exe
  C:\Windows\System\LvFeCqC.exe
  2⤵
  PID:7816
- C:\Windows\System\LVHVFqP.exe
  C:\Windows\System\LVHVFqP.exe
  2⤵
  PID:7772
- C:\Windows\System\eSnKHCe.exe
  C:\Windows\System\eSnKHCe.exe
  2⤵
  PID:7784
- C:\Windows\System\vVpcWjz.exe
  C:\Windows\System\vVpcWjz.exe
  2⤵
  PID:7932
- C:\Windows\System\IFMPnVU.exe
  C:\Windows\System\IFMPnVU.exe
  2⤵
  PID:7972
- C:\Windows\System\WJlyfdu.exe
  C:\Windows\System\WJlyfdu.exe
  2⤵
  PID:8156
- C:\Windows\System\VVDNWbN.exe
  C:\Windows\System\VVDNWbN.exe
  2⤵
  PID:8120
- C:\Windows\System\KUbHOWT.exe
  C:\Windows\System\KUbHOWT.exe
  2⤵
  PID:8040
- C:\Windows\System\AQRQzPk.exe
  C:\Windows\System\AQRQzPk.exe
  2⤵
  PID:8076
- C:\Windows\System\nsCFAIh.exe
  C:\Windows\System\nsCFAIh.exe
  2⤵
  PID:8168
- C:\Windows\System\ImhsAzS.exe
  C:\Windows\System\ImhsAzS.exe
  2⤵
  PID:7416
- C:\Windows\System\Wktzgrq.exe
  C:\Windows\System\Wktzgrq.exe
  2⤵
  PID:6400
- C:\Windows\System\myXIJAO.exe
  C:\Windows\System\myXIJAO.exe
  2⤵
  PID:7344
- C:\Windows\System\SlMWzHV.exe
  C:\Windows\System\SlMWzHV.exe
  2⤵
  PID:6336
- C:\Windows\System\RSOhDqy.exe
  C:\Windows\System\RSOhDqy.exe
  2⤵
  PID:7036
- C:\Windows\System\JOmFdFL.exe
  C:\Windows\System\JOmFdFL.exe
  2⤵
  PID:7180
- C:\Windows\System\qGQmjKH.exe
  C:\Windows\System\qGQmjKH.exe
  2⤵
  PID:7536
- C:\Windows\System\CTtXFwu.exe
  C:\Windows\System\CTtXFwu.exe
  2⤵
  PID:7548
- C:\Windows\System\SLoykBB.exe
  C:\Windows\System\SLoykBB.exe
  2⤵
  PID:7572
- C:\Windows\System\fgzTWpl.exe
  C:\Windows\System\fgzTWpl.exe
  2⤵
  PID:7880
- C:\Windows\System\lzXSEdN.exe
  C:\Windows\System\lzXSEdN.exe
  2⤵
  PID:7884
- C:\Windows\System\wsOaRvQ.exe
  C:\Windows\System\wsOaRvQ.exe
  2⤵
  PID:7956
- C:\Windows\System\THmTIgL.exe
  C:\Windows\System\THmTIgL.exe
  2⤵
  PID:7680
- C:\Windows\System\moqCrLm.exe
  C:\Windows\System\moqCrLm.exe
  2⤵
  PID:8024
- C:\Windows\System\VraIJMO.exe
  C:\Windows\System\VraIJMO.exe
  2⤵
  PID:8044
- C:\Windows\System\tNhybuO.exe
  C:\Windows\System\tNhybuO.exe
  2⤵
  PID:6096
- C:\Windows\System\vtdFLDt.exe
  C:\Windows\System\vtdFLDt.exe
  2⤵
  PID:8004
- C:\Windows\System\diJXymI.exe
  C:\Windows\System\diJXymI.exe
  2⤵
  PID:7560
- C:\Windows\System\KuqDogE.exe
  C:\Windows\System\KuqDogE.exe
  2⤵
  PID:6416
- C:\Windows\System\TYyCJxV.exe
  C:\Windows\System\TYyCJxV.exe
  2⤵
  PID:7676
- C:\Windows\System\osmPQFP.exe
  C:\Windows\System\osmPQFP.exe
  2⤵
  PID:7100
- C:\Windows\System\lSsQmhw.exe
  C:\Windows\System\lSsQmhw.exe
  2⤵
  PID:7924
- C:\Windows\System\sLXTdHN.exe
  C:\Windows\System\sLXTdHN.exe
  2⤵
  PID:7692
- C:\Windows\System\RObceYB.exe
  C:\Windows\System\RObceYB.exe
  2⤵
  PID:7072
- C:\Windows\System\uSBcGhj.exe
  C:\Windows\System\uSBcGhj.exe
  2⤵
  PID:7448
- C:\Windows\System\ImrEXQO.exe
  C:\Windows\System\ImrEXQO.exe
  2⤵
  PID:7360
- C:\Windows\System\fTYJIEb.exe
  C:\Windows\System\fTYJIEb.exe
  2⤵
  PID:6264
- C:\Windows\System\WxByAZc.exe
  C:\Windows\System\WxByAZc.exe
  2⤵
  PID:7380
- C:\Windows\System\XtRbOGF.exe
  C:\Windows\System\XtRbOGF.exe
  2⤵
  PID:7800
- C:\Windows\System\XawkDhw.exe
  C:\Windows\System\XawkDhw.exe
  2⤵
  PID:8204
- C:\Windows\System\LZtFXdF.exe
  C:\Windows\System\LZtFXdF.exe
  2⤵
  PID:8220
- C:\Windows\System\iUPWDCa.exe
  C:\Windows\System\iUPWDCa.exe
  2⤵
  PID:8260
- C:\Windows\System\UZJPWGr.exe
  C:\Windows\System\UZJPWGr.exe
  2⤵
  PID:8276
- C:\Windows\System\iNzxXhl.exe
  C:\Windows\System\iNzxXhl.exe
  2⤵
  PID:8292
- C:\Windows\System\ZrPRjhL.exe
  C:\Windows\System\ZrPRjhL.exe
  2⤵
  PID:8312
- C:\Windows\System\APkvHQa.exe
  C:\Windows\System\APkvHQa.exe
  2⤵
  PID:8328
- C:\Windows\System\HgnsMBs.exe
  C:\Windows\System\HgnsMBs.exe
  2⤵
  PID:8344
- C:\Windows\System\KsUkCer.exe
  C:\Windows\System\KsUkCer.exe
  2⤵
  PID:8360
- C:\Windows\System\NLRvuYE.exe
  C:\Windows\System\NLRvuYE.exe
  2⤵
  PID:8376
- C:\Windows\System\cPLqYpe.exe
  C:\Windows\System\cPLqYpe.exe
  2⤵
  PID:8596
- C:\Windows\System\KYuCsCF.exe
  C:\Windows\System\KYuCsCF.exe
  2⤵
  PID:8624
- C:\Windows\System\CizlKwG.exe
  C:\Windows\System\CizlKwG.exe
  2⤵
  PID:8640
- C:\Windows\System\ncwFdcN.exe
  C:\Windows\System\ncwFdcN.exe
  2⤵
  PID:8656
- C:\Windows\System\aGQIskM.exe
  C:\Windows\System\aGQIskM.exe
  2⤵
  PID:8680
- C:\Windows\System\ZiJhVGw.exe
  C:\Windows\System\ZiJhVGw.exe
  2⤵
  PID:8696
- C:\Windows\System\leywDqq.exe
  C:\Windows\System\leywDqq.exe
  2⤵
  PID:8720
- C:\Windows\System\Igmcyqr.exe
  C:\Windows\System\Igmcyqr.exe
  2⤵
  PID:8736
- C:\Windows\System\tLAnjuo.exe
  C:\Windows\System\tLAnjuo.exe
  2⤵
  PID:8772
- C:\Windows\System\rVhwqme.exe
  C:\Windows\System\rVhwqme.exe
  2⤵
  PID:8900
- C:\Windows\System\faVwkcs.exe
  C:\Windows\System\faVwkcs.exe
  2⤵
  PID:8916
- C:\Windows\System\UlSjpPc.exe
  C:\Windows\System\UlSjpPc.exe
  2⤵
  PID:8932
- C:\Windows\System\loepTom.exe
  C:\Windows\System\loepTom.exe
  2⤵
  PID:8948
- C:\Windows\System\ckuvoOo.exe
  C:\Windows\System\ckuvoOo.exe
  2⤵
  PID:8964
- C:\Windows\System\VDUHfuB.exe
  C:\Windows\System\VDUHfuB.exe
  2⤵
  PID:9004
- C:\Windows\System\NMSzvZg.exe
  C:\Windows\System\NMSzvZg.exe
  2⤵
  PID:9020
- C:\Windows\System\JDBKPek.exe
  C:\Windows\System\JDBKPek.exe
  2⤵
  PID:9056
- C:\Windows\System\XeMuUIS.exe
  C:\Windows\System\XeMuUIS.exe
  2⤵
  PID:9072
- C:\Windows\System\oRIyRYM.exe
  C:\Windows\System\oRIyRYM.exe
  2⤵
  PID:9088
- C:\Windows\System\aKoAVVq.exe
  C:\Windows\System\aKoAVVq.exe
  2⤵
  PID:9104
- C:\Windows\System\UCaPcZS.exe
  C:\Windows\System\UCaPcZS.exe
  2⤵
  PID:9120
- C:\Windows\System\GLumxXs.exe
  C:\Windows\System\GLumxXs.exe
  2⤵
  PID:9136
- C:\Windows\System\PrzYxQm.exe
  C:\Windows\System\PrzYxQm.exe
  2⤵
  PID:9152
- C:\Windows\System\dZxLRTb.exe
  C:\Windows\System\dZxLRTb.exe
  2⤵
  PID:9168
- C:\Windows\System\ktmvSWo.exe
  C:\Windows\System\ktmvSWo.exe
  2⤵
  PID:7908
- C:\Windows\System\qhWrHKQ.exe
  C:\Windows\System\qhWrHKQ.exe
  2⤵
  PID:7936
- C:\Windows\System\lAgMDyy.exe
  C:\Windows\System\lAgMDyy.exe
  2⤵
  PID:7304
- C:\Windows\System\wqmDfMi.exe
  C:\Windows\System\wqmDfMi.exe
  2⤵
  PID:7712
- C:\Windows\System\zSthkHF.exe
  C:\Windows\System\zSthkHF.exe
  2⤵
  PID:7672
- C:\Windows\System\ekVSYrx.exe
  C:\Windows\System\ekVSYrx.exe
  2⤵
  PID:7960
- C:\Windows\System\TPPwahq.exe
  C:\Windows\System\TPPwahq.exe
  2⤵
  PID:7300
- C:\Windows\System\ryllmhv.exe
  C:\Windows\System\ryllmhv.exe
  2⤵
  PID:8268
- C:\Windows\System\vZVLNBA.exe
  C:\Windows\System\vZVLNBA.exe
  2⤵
  PID:8308
- C:\Windows\System\AHOHUVJ.exe
  C:\Windows\System\AHOHUVJ.exe
  2⤵
  PID:8140
- C:\Windows\System\yxQClUu.exe
  C:\Windows\System\yxQClUu.exe
  2⤵
  PID:8284
- C:\Windows\System\LlPMgMN.exe
  C:\Windows\System\LlPMgMN.exe
  2⤵
  PID:8324
- C:\Windows\System\wTpxeNJ.exe
  C:\Windows\System\wTpxeNJ.exe
  2⤵
  PID:8392
- C:\Windows\System\JDBSmLm.exe
  C:\Windows\System\JDBSmLm.exe
  2⤵
  PID:8388
- C:\Windows\System\UlfoVrU.exe
  C:\Windows\System\UlfoVrU.exe
  2⤵
  PID:8432
- C:\Windows\System\BGMYbGa.exe
  C:\Windows\System\BGMYbGa.exe
  2⤵
  PID:8468
- C:\Windows\System\lHAtSuO.exe
  C:\Windows\System\lHAtSuO.exe
  2⤵
  PID:8500
- C:\Windows\System\HLktjVg.exe
  C:\Windows\System\HLktjVg.exe
  2⤵
  PID:8536
- C:\Windows\System\pTlAZOs.exe
  C:\Windows\System\pTlAZOs.exe
  2⤵
  PID:8552
- C:\Windows\System\LXwGnxx.exe
  C:\Windows\System\LXwGnxx.exe
  2⤵
  PID:8408
- C:\Windows\System\akifHAL.exe
  C:\Windows\System\akifHAL.exe
  2⤵
  PID:8436
- C:\Windows\System\vJerZpu.exe
  C:\Windows\System\vJerZpu.exe
  2⤵
  PID:8488
- C:\Windows\System\btFnxfe.exe
  C:\Windows\System\btFnxfe.exe
  2⤵
  PID:8568
- C:\Windows\System\WENSrrR.exe
  C:\Windows\System\WENSrrR.exe
  2⤵
  PID:8516
- C:\Windows\System\XXoSQTL.exe
  C:\Windows\System\XXoSQTL.exe
  2⤵
  PID:8584
- C:\Windows\System\HJfssIc.exe
  C:\Windows\System\HJfssIc.exe
  2⤵
  PID:2060
- C:\Windows\System\jbcmVgj.exe
  C:\Windows\System\jbcmVgj.exe
  2⤵
  PID:8620
- C:\Windows\System\TUuhgWc.exe
  C:\Windows\System\TUuhgWc.exe
  2⤵
  PID:8692
- C:\Windows\System\mwEgbzT.exe
  C:\Windows\System\mwEgbzT.exe
  2⤵
  PID:8708
- C:\Windows\System\YCzuNSm.exe
  C:\Windows\System\YCzuNSm.exe
  2⤵
  PID:8632
- C:\Windows\System\QTQiGSE.exe
  C:\Windows\System\QTQiGSE.exe
  2⤵
  PID:8672
- C:\Windows\System\mwbIcwI.exe
  C:\Windows\System\mwbIcwI.exe
  2⤵
  PID:8780
- C:\Windows\System\wtZIeqn.exe
  C:\Windows\System\wtZIeqn.exe
  2⤵
  PID:2464
- C:\Windows\System\xKVCkDx.exe
  C:\Windows\System\xKVCkDx.exe
  2⤵
  PID:1488
- C:\Windows\System\mqjALdI.exe
  C:\Windows\System\mqjALdI.exe
  2⤵
  PID:8768
- C:\Windows\System\eaWyZdv.exe
  C:\Windows\System\eaWyZdv.exe
  2⤵
  PID:8996
- C:\Windows\System\APxkBBI.exe
  C:\Windows\System\APxkBBI.exe
  2⤵
  PID:8788
- C:\Windows\System\SKnFbXy.exe
  C:\Windows\System\SKnFbXy.exe
  2⤵
  PID:8804
- C:\Windows\System\wRTiVoc.exe
  C:\Windows\System\wRTiVoc.exe
  2⤵
  PID:8824
- C:\Windows\System\GLDESAC.exe
  C:\Windows\System\GLDESAC.exe
  2⤵
  PID:8852
- C:\Windows\System\VRPQXid.exe
  C:\Windows\System\VRPQXid.exe
  2⤵
  PID:8880
- C:\Windows\System\cIRhZGi.exe
  C:\Windows\System\cIRhZGi.exe
  2⤵
  PID:8808
- C:\Windows\System\UlbkkWL.exe
  C:\Windows\System\UlbkkWL.exe
  2⤵
  PID:8960
- C:\Windows\System\ujZKvkX.exe
  C:\Windows\System\ujZKvkX.exe
  2⤵
  PID:9064
- C:\Windows\System\MnxHdes.exe
  C:\Windows\System\MnxHdes.exe
  2⤵
  PID:9132
- C:\Windows\System\GUIVDxM.exe
  C:\Windows\System\GUIVDxM.exe
  2⤵
  PID:9044
- C:\Windows\System\qqfwJmt.exe
  C:\Windows\System\qqfwJmt.exe
  2⤵
  PID:9144
- C:\Windows\System\aNPxgDi.exe
  C:\Windows\System\aNPxgDi.exe
  2⤵
  PID:8984
- C:\Windows\System\ilpFsEr.exe
  C:\Windows\System\ilpFsEr.exe
  2⤵
  PID:6532
- C:\Windows\System\BIrwxDd.exe
  C:\Windows\System\BIrwxDd.exe
  2⤵
  PID:8072
- C:\Windows\System\QUaLzNa.exe
  C:\Windows\System\QUaLzNa.exe
  2⤵
  PID:8340
- C:\Windows\System\zgsPcze.exe
  C:\Windows\System\zgsPcze.exe
  2⤵
  PID:9052
- C:\Windows\System\ckrEuAa.exe
  C:\Windows\System\ckrEuAa.exe
  2⤵
  PID:7940
- C:\Windows\System\EiJaOwd.exe
  C:\Windows\System\EiJaOwd.exe
  2⤵
  PID:7340
- C:\Windows\System\rDiOwaF.exe
  C:\Windows\System\rDiOwaF.exe
  2⤵
  PID:8108
- C:\Windows\System\nYhVGZh.exe
  C:\Windows\System\nYhVGZh.exe
  2⤵
  PID:8300
- C:\Windows\System\qbOBdpu.exe
  C:\Windows\System\qbOBdpu.exe
  2⤵
  PID:9196
- C:\Windows\System\INfUbkl.exe
  C:\Windows\System\INfUbkl.exe
  2⤵
  PID:8412
- C:\Windows\System\RDQoCTA.exe
  C:\Windows\System\RDQoCTA.exe
  2⤵
  PID:8460
- C:\Windows\System\jxkbiyt.exe
  C:\Windows\System\jxkbiyt.exe
  2⤵
  PID:8248
- C:\Windows\System\yHLhfnx.exe
  C:\Windows\System\yHLhfnx.exe
  2⤵
  PID:8528
- C:\Windows\System\RakqoqJ.exe
  C:\Windows\System\RakqoqJ.exe
  2⤵
  PID:8580
- C:\Windows\System\KrPTYNO.exe
  C:\Windows\System\KrPTYNO.exe
  2⤵
  PID:8472
- C:\Windows\System\neNDZly.exe
  C:\Windows\System\neNDZly.exe
  2⤵
  PID:8560
- C:\Windows\System\nuaAozz.exe
  C:\Windows\System\nuaAozz.exe
  2⤵
  PID:8512
- C:\Windows\System\coAyVLm.exe
  C:\Windows\System\coAyVLm.exe
  2⤵
  PID:8588
- C:\Windows\System\IlkxUeS.exe
  C:\Windows\System\IlkxUeS.exe
  2⤵
  PID:876
- C:\Windows\System\AkZBNEX.exe
  C:\Windows\System\AkZBNEX.exe
  2⤵
  PID:8732
- C:\Windows\System\XbooXtM.exe
  C:\Windows\System\XbooXtM.exe
  2⤵
  PID:8748
- C:\Windows\System\WjjhcKh.exe
  C:\Windows\System\WjjhcKh.exe
  2⤵
  PID:8912
- C:\Windows\System\zerBnKS.exe
  C:\Windows\System\zerBnKS.exe
  2⤵
  PID:8756
- C:\Windows\System\bpzZKBC.exe
  C:\Windows\System\bpzZKBC.exe
  2⤵
  PID:8796
- C:\Windows\System\eCdCYRA.exe
  C:\Windows\System\eCdCYRA.exe
  2⤵
  PID:8980
- C:\Windows\System\CfSgPqT.exe
  C:\Windows\System\CfSgPqT.exe
  2⤵
  PID:8976
- C:\Windows\System\SauqLxn.exe
  C:\Windows\System\SauqLxn.exe
  2⤵
  PID:2176
- C:\Windows\System\cNmUjOa.exe
  C:\Windows\System\cNmUjOa.exe
  2⤵
  PID:8892
- C:\Windows\System\zOYohWR.exe
  C:\Windows\System\zOYohWR.exe
  2⤵
  PID:9164
- C:\Windows\System\FRIEMKe.exe
  C:\Windows\System\FRIEMKe.exe
  2⤵
  PID:8868
- C:\Windows\System\EkwhrbU.exe
  C:\Windows\System\EkwhrbU.exe
  2⤵
  PID:7988
- C:\Windows\System\AhDZQSK.exe
  C:\Windows\System\AhDZQSK.exe
  2⤵
  PID:9100
- C:\Windows\System\ImbzSNU.exe
  C:\Windows\System\ImbzSNU.exe
  2⤵
  PID:9200
- C:\Windows\System\nAYVFUf.exe
  C:\Windows\System\nAYVFUf.exe
  2⤵
  PID:9212
- C:\Windows\System\KEbNJwI.exe
  C:\Windows\System\KEbNJwI.exe
  2⤵
  PID:7532
- C:\Windows\System\hRarWxX.exe
  C:\Windows\System\hRarWxX.exe
  2⤵
  PID:7904
- C:\Windows\System\evQoApI.exe
  C:\Windows\System\evQoApI.exe
  2⤵
  PID:8288
- C:\Windows\System\MfWZZMm.exe
  C:\Windows\System\MfWZZMm.exe
  2⤵
  PID:8484
- C:\Windows\System\CtydAVF.exe
  C:\Windows\System\CtydAVF.exe
  2⤵
  PID:8860
- C:\Windows\System\AkQGfsw.exe
  C:\Windows\System\AkQGfsw.exe
  2⤵
  PID:9180
- C:\Windows\System\vSNfSjB.exe
  C:\Windows\System\vSNfSjB.exe
  2⤵
  PID:8508
- C:\Windows\System\IYjrIxs.exe
  C:\Windows\System\IYjrIxs.exe
  2⤵
  PID:8524
- C:\Windows\System\GbrkZJD.exe
  C:\Windows\System\GbrkZJD.exe
  2⤵
  PID:8424
- C:\Windows\System\FcDvwUd.exe
  C:\Windows\System\FcDvwUd.exe
  2⤵
  PID:8652
- C:\Windows\System\CPAeZkK.exe
  C:\Windows\System\CPAeZkK.exe
  2⤵
  PID:2452
- C:\Windows\System\eEgXRJj.exe
  C:\Windows\System\eEgXRJj.exe
  2⤵
  PID:8564
- C:\Windows\System\myQzKPd.exe
  C:\Windows\System\myQzKPd.exe
  2⤵
  PID:8668
- C:\Windows\System\OLCMjpq.exe
  C:\Windows\System\OLCMjpq.exe
  2⤵
  PID:8972
- C:\Windows\System\gAVgKGV.exe
  C:\Windows\System\gAVgKGV.exe
  2⤵
  PID:9036
- C:\Windows\System\lbRudTO.exe
  C:\Windows\System\lbRudTO.exe
  2⤵
  PID:9032
- C:\Windows\System\tJUztqx.exe
  C:\Windows\System\tJUztqx.exe
  2⤵
  PID:8848
- C:\Windows\System\NjolvEl.exe
  C:\Windows\System\NjolvEl.exe
  2⤵
  PID:9188
- C:\Windows\System\BowlxvZ.exe
  C:\Windows\System\BowlxvZ.exe
  2⤵
  PID:8368
- C:\Windows\System\qerflNs.exe
  C:\Windows\System\qerflNs.exe
  2⤵
  PID:8212
- C:\Windows\System\hRJmgWH.exe
  C:\Windows\System\hRJmgWH.exe
  2⤵
  PID:8320
- C:\Windows\System\DSpyXRH.exe
  C:\Windows\System\DSpyXRH.exe
  2⤵
  PID:8876
- C:\Windows\System\vgTAbeF.exe
  C:\Windows\System\vgTAbeF.exe
  2⤵
  PID:8400
- C:\Windows\System\mUuRVNW.exe
  C:\Windows\System\mUuRVNW.exe
  2⤵
  PID:8992
- C:\Windows\System\ZPAYFuL.exe
  C:\Windows\System\ZPAYFuL.exe
  2⤵
  PID:9012
- C:\Windows\System\cgeVJkW.exe
  C:\Windows\System\cgeVJkW.exe
  2⤵
  PID:8864
- C:\Windows\System\uYnuXRQ.exe
  C:\Windows\System\uYnuXRQ.exe
  2⤵
  PID:9192
- C:\Windows\System\JBWYOLg.exe
  C:\Windows\System\JBWYOLg.exe
  2⤵
  PID:9116
- C:\Windows\System\xAwiLuR.exe
  C:\Windows\System\xAwiLuR.exe
  2⤵
  PID:6700
- C:\Windows\System\cqwGfKV.exe
  C:\Windows\System\cqwGfKV.exe
  2⤵
  PID:9228
- C:\Windows\System\qteCGZs.exe
  C:\Windows\System\qteCGZs.exe
  2⤵
  PID:9248
- C:\Windows\System\MvOQyIK.exe
  C:\Windows\System\MvOQyIK.exe
  2⤵
  PID:9264
- C:\Windows\System\cYEXRsY.exe
  C:\Windows\System\cYEXRsY.exe
  2⤵
  PID:9280
- C:\Windows\System\RdJqvvR.exe
  C:\Windows\System\RdJqvvR.exe
  2⤵
  PID:9296
- C:\Windows\System\wvJEAqM.exe
  C:\Windows\System\wvJEAqM.exe
  2⤵
  PID:9312
- C:\Windows\System\mtKQhGM.exe
  C:\Windows\System\mtKQhGM.exe
  2⤵
  PID:9328
- C:\Windows\System\UMcrJxi.exe
  C:\Windows\System\UMcrJxi.exe
  2⤵
  PID:9344
- C:\Windows\System\UslTrYp.exe
  C:\Windows\System\UslTrYp.exe
  2⤵
  PID:9360
- C:\Windows\System\tAKTkEN.exe
  C:\Windows\System\tAKTkEN.exe
  2⤵
  PID:9376
- C:\Windows\System\NjDaAuf.exe
  C:\Windows\System\NjDaAuf.exe
  2⤵
  PID:9392
- C:\Windows\System\byZDZfP.exe
  C:\Windows\System\byZDZfP.exe
  2⤵
  PID:9408
- C:\Windows\System\ShWtMeo.exe
  C:\Windows\System\ShWtMeo.exe
  2⤵
  PID:9424
- C:\Windows\System\EbGPwKz.exe
  C:\Windows\System\EbGPwKz.exe
  2⤵
  PID:9440
- C:\Windows\System\fjBBXqT.exe
  C:\Windows\System\fjBBXqT.exe
  2⤵
  PID:9456
- C:\Windows\System\IpOpTKQ.exe
  C:\Windows\System\IpOpTKQ.exe
  2⤵
  PID:9472
- C:\Windows\System\wPnoTcz.exe
  C:\Windows\System\wPnoTcz.exe
  2⤵
  PID:9488
- C:\Windows\System\caskFpE.exe
  C:\Windows\System\caskFpE.exe
  2⤵
  PID:9504
- C:\Windows\System\KjcWwFG.exe
  C:\Windows\System\KjcWwFG.exe
  2⤵
  PID:9520
- C:\Windows\System\ogWjOkl.exe
  C:\Windows\System\ogWjOkl.exe
  2⤵
  PID:9536
- C:\Windows\System\KLnFzvx.exe
  C:\Windows\System\KLnFzvx.exe
  2⤵
  PID:9552
- C:\Windows\System\ALHMIUv.exe
  C:\Windows\System\ALHMIUv.exe
  2⤵
  PID:9568
- C:\Windows\System\XEgjxWn.exe
  C:\Windows\System\XEgjxWn.exe
  2⤵
  PID:9584
- C:\Windows\System\tCvVkpU.exe
  C:\Windows\System\tCvVkpU.exe
  2⤵
  PID:9600
- C:\Windows\System\MUKhJTU.exe
  C:\Windows\System\MUKhJTU.exe
  2⤵
  PID:9624
- C:\Windows\System\YrwYAxo.exe
  C:\Windows\System\YrwYAxo.exe
  2⤵
  PID:9684
- C:\Windows\System\cTIfECt.exe
  C:\Windows\System\cTIfECt.exe
  2⤵
  PID:9748
- C:\Windows\System\Nauajgv.exe
  C:\Windows\System\Nauajgv.exe
  2⤵
  PID:9764
- C:\Windows\System\SbFuLwE.exe
  C:\Windows\System\SbFuLwE.exe
  2⤵
  PID:9780
- C:\Windows\System\XoxLXLM.exe
  C:\Windows\System\XoxLXLM.exe
  2⤵
  PID:9796
- C:\Windows\System\fERkPIz.exe
  C:\Windows\System\fERkPIz.exe
  2⤵
  PID:9812
- C:\Windows\System\OcPkNzp.exe
  C:\Windows\System\OcPkNzp.exe
  2⤵
  PID:9828
- C:\Windows\System\scLvmAg.exe
  C:\Windows\System\scLvmAg.exe
  2⤵
  PID:9844
- C:\Windows\System\MXFTWYv.exe
  C:\Windows\System\MXFTWYv.exe
  2⤵
  PID:9860
- C:\Windows\System\XlyKpFo.exe
  C:\Windows\System\XlyKpFo.exe
  2⤵
  PID:9876
- C:\Windows\System\exaTjDy.exe
  C:\Windows\System\exaTjDy.exe
  2⤵
  PID:9892
- C:\Windows\System\CgmjhBn.exe
  C:\Windows\System\CgmjhBn.exe
  2⤵
  PID:9912
- C:\Windows\System\OzDuqoQ.exe
  C:\Windows\System\OzDuqoQ.exe
  2⤵
  PID:9932
- C:\Windows\System\XINiuUc.exe
  C:\Windows\System\XINiuUc.exe
  2⤵
  PID:9948
- C:\Windows\System\ofBdPHQ.exe
  C:\Windows\System\ofBdPHQ.exe
  2⤵
  PID:9964
- C:\Windows\System\tEliBkq.exe
  C:\Windows\System\tEliBkq.exe
  2⤵
  PID:9984
- C:\Windows\System\xSxOliB.exe
  C:\Windows\System\xSxOliB.exe
  2⤵
  PID:10000
- C:\Windows\System\FanwKAg.exe
  C:\Windows\System\FanwKAg.exe
  2⤵
  PID:10016
- C:\Windows\System\OHrkDEd.exe
  C:\Windows\System\OHrkDEd.exe
  2⤵
  PID:10032
- C:\Windows\System\VRTggyL.exe
  C:\Windows\System\VRTggyL.exe
  2⤵
  PID:10052
- C:\Windows\System\OZxFiCk.exe
  C:\Windows\System\OZxFiCk.exe
  2⤵
  PID:10068
- C:\Windows\System\PHlfgQZ.exe
  C:\Windows\System\PHlfgQZ.exe
  2⤵
  PID:10084
- C:\Windows\System\bHKmFMD.exe
  C:\Windows\System\bHKmFMD.exe
  2⤵
  PID:10108
- C:\Windows\System\WubhMrD.exe
  C:\Windows\System\WubhMrD.exe
  2⤵
  PID:10128
- C:\Windows\System\GcxfeZE.exe
  C:\Windows\System\GcxfeZE.exe
  2⤵
  PID:10144
- C:\Windows\System\povGEga.exe
  C:\Windows\System\povGEga.exe
  2⤵
  PID:10160
- C:\Windows\System\dVOrZlx.exe
  C:\Windows\System\dVOrZlx.exe
  2⤵
  PID:10176
- C:\Windows\System\ehhjFTL.exe
  C:\Windows\System\ehhjFTL.exe
  2⤵
  PID:10192
- C:\Windows\System\WYdbbwR.exe
  C:\Windows\System\WYdbbwR.exe
  2⤵
  PID:10208
- C:\Windows\System\RgZxUCI.exe
  C:\Windows\System\RgZxUCI.exe
  2⤵
  PID:10224
- C:\Windows\System\BGmtHbv.exe
  C:\Windows\System\BGmtHbv.exe
  2⤵
  PID:9220
- C:\Windows\System\AQhBLfy.exe
  C:\Windows\System\AQhBLfy.exe
  2⤵
  PID:8844
- C:\Windows\System\QItfaWu.exe
  C:\Windows\System\QItfaWu.exe
  2⤵
  PID:7912
- C:\Windows\System\YfrarVJ.exe
  C:\Windows\System\YfrarVJ.exe
  2⤵
  PID:1712
- C:\Windows\System\mmqYEQv.exe
  C:\Windows\System\mmqYEQv.exe
  2⤵
  PID:9204
- C:\Windows\System\PTGXXwb.exe
  C:\Windows\System\PTGXXwb.exe
  2⤵
  PID:9260
- C:\Windows\System\IIzegdf.exe
  C:\Windows\System\IIzegdf.exe
  2⤵
  PID:9324
- C:\Windows\System\izzaERu.exe
  C:\Windows\System\izzaERu.exe
  2⤵
  PID:9240
- C:\Windows\System\yfDLZuP.exe
  C:\Windows\System\yfDLZuP.exe
  2⤵
  PID:9388
- C:\Windows\System\NOrQxnr.exe
  C:\Windows\System\NOrQxnr.exe
  2⤵
  PID:9448
- C:\Windows\System\HXeFcmR.exe
  C:\Windows\System\HXeFcmR.exe
  2⤵
  PID:9304
- C:\Windows\System\qtOKyAz.exe
  C:\Windows\System\qtOKyAz.exe
  2⤵
  PID:9404
- C:\Windows\System\hFUrQMk.exe
  C:\Windows\System\hFUrQMk.exe
  2⤵
  PID:9468
- C:\Windows\System\ELhzDTN.exe
  C:\Windows\System\ELhzDTN.exe
  2⤵
  PID:9548
- C:\Windows\System\gCZUPCa.exe
  C:\Windows\System\gCZUPCa.exe
  2⤵
  PID:9560
- C:\Windows\System\aeigwLE.exe
  C:\Windows\System\aeigwLE.exe
  2⤵
  PID:9608
- C:\Windows\System\SSBDypg.exe
  C:\Windows\System\SSBDypg.exe
  2⤵
  PID:8464
- C:\Windows\System\ijBRmkp.exe
  C:\Windows\System\ijBRmkp.exe
  2⤵
  PID:9632
- C:\Windows\System\PnhwuzV.exe
  C:\Windows\System\PnhwuzV.exe
  2⤵
  PID:9648
- C:\Windows\System\KlYBLas.exe
  C:\Windows\System\KlYBLas.exe
  2⤵
  PID:9672
- C:\Windows\System\MIwrrVN.exe
  C:\Windows\System\MIwrrVN.exe
  2⤵
  PID:9664
- C:\Windows\System\MDUlKNB.exe
  C:\Windows\System\MDUlKNB.exe
  2⤵
  PID:9704
- C:\Windows\System\uMWPXUJ.exe
  C:\Windows\System\uMWPXUJ.exe
  2⤵
  PID:9756
- C:\Windows\System\mBxOnRK.exe
  C:\Windows\System\mBxOnRK.exe
  2⤵
  PID:9792
- C:\Windows\System\IBsJamv.exe
  C:\Windows\System\IBsJamv.exe
  2⤵
  PID:9736
- C:\Windows\System\WrmdTxw.exe
  C:\Windows\System\WrmdTxw.exe
  2⤵
  PID:9776
- C:\Windows\System\zrpSDSt.exe
  C:\Windows\System\zrpSDSt.exe
  2⤵
  PID:9820
- C:\Windows\System\dOYamRa.exe
  C:\Windows\System\dOYamRa.exe
  2⤵
  PID:9852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DLIXPXz.exe

Filesize
1.9MB

MD5
0c0a96679ad2503c1ab33002e0b2e9e1

SHA1
abf8281243d505da8e23dffb18b1930c6e815b5f

SHA256
119a7e60548345face12124bcc5bc47db10408340cf659afe36552fef59647f1

SHA512
415328b5d25acc021ff5dedf103d5f4961e4130e38d0d492919d01e21fa65bb7751341af399acf405e2acce6e4201aeb4b95ae601dec2d8718616e4f092ad834

Download Submit
C:\Windows\system\GNSWSlv.exe

Filesize
1.9MB

MD5
0f948a58a2929983b55453a48f6d20d8

SHA1
3fe3e5d51d0cc74f5b3494b2754f6af9d9086525

SHA256
9ecd63b3875e0e1c79a539da555f4b194f1e763d79dfbc01d232e610d85c0375

SHA512
4fda3a747ba959c301cdff220f744ab9bde58b5711bfb302313f36663c3c31ac762e258a28329ee6d70d036d3c033111acb807fbbeecdd1aea1a8ff7ddb314ed

Download Submit
C:\Windows\system\HWdeFjT.exe

Filesize
1.9MB

MD5
432828474506eb677249a7ff35a2a313

SHA1
efd99bbfa0342d53ed2287230a20cde7128dab23

SHA256
1daead12eaaf7a8381c5aa875852b4236e47d1aab06590f8a7ac16e28630ff1e

SHA512
8ae2d98027f03a5b6dfad2bb5f01244f95285823ec30e4a9ba90221ced7072269f0d2b95caa890928022d722aef134c30b21adb87cdd9026a1878bbb342808f3

Download Submit
C:\Windows\system\IDCkIRH.exe

Filesize
1.9MB

MD5
b8e71aa30ec48b3ffcd51414db5a9b73

SHA1
6658858582bc53098cca0bf1f63e623eb479ef09

SHA256
46338de2115b1caa392baefc62b1697e61159c4ef3d04a1e9507f2d2c6b601dc

SHA512
b54d95529e6553936e80343d9a628791b6972df3a5753b4a7d98c420d4bb2fd88b34e65661f763d99248d8fd4f42f1e986e6d9d7d9a64e7b9ce6c8f4fe6bec6e

Download Submit
C:\Windows\system\IYXIWkw.exe

Filesize
1.9MB

MD5
61af59a38ec9a0a2c6ddf03c3eb11fd5

SHA1
66e87e2be1b3c392aae50aa6b80211dcf91255a9

SHA256
35bc091c19ac1774e051793cec3d8abe27aacc91dc50ca64123a217fa9c4e138

SHA512
7f78096c7c3c487e2b2a639d70b5d31deb64f17801afe5ecce126cf9d16a076f7526b955b6e96fc53d8c87f5022b7afd23e5b826ff04642526b238e0fdf286c3

Download Submit
C:\Windows\system\IqEmoWs.exe

Filesize
1.9MB

MD5
0e6601d34e903c48c8d55e1d89746fd6

SHA1
29579912fc3b0eceaf7c404cc11b17c07cf196ff

SHA256
a0ce76ebdc107a31aac58811ed4d18afad2a92612e30f584471da91dab5c67a8

SHA512
017042d0af9f60f4a49cd0738889c50a44e3c0851eeabee866d3de78ec3cb6f282bd99883f4f4714e8714d4f5e715f49decf516198d1d8bf4b9a9662a32057bb

Download Submit
C:\Windows\system\JzprVvt.exe

Filesize
1.9MB

MD5
3ca375955e8a44c7fe3cbf3152d9c9d3

SHA1
ab543443178b7f9b8d5ec61b65dc49c006ea9d51

SHA256
789c121750e8bcf1e9afc362395c4f86484ca3cbb23ba1a966725627127a23c1

SHA512
92372e77dcebfe905a9d6755f9eff700563d12e344dee75b59083679211e34ef0908db2895f4c545970cf1b1206cca7313f142242d1d4213bf2c602475e71c79

Download Submit
C:\Windows\system\KwbTePr.exe

Filesize
1.9MB

MD5
d695376265da1b9850009aa583a2a353

SHA1
020590e76c18f5660d1e7bf8d5de5289d410b6c3

SHA256
3409a7daa91d9ec1463134fb46044218f9aeec0048bfc15a1aaa907bd49b84e9

SHA512
0c3fbd9da294463e6dc1d75b96a9edff37d4b15913569fdad5c5961dea9d1ebac286b6d721fd173f0e9e8a26828ea62cbadbb8e118ddcce0152246ed91d77d80

Download Submit
C:\Windows\system\LPvxnMa.exe

Filesize
1.9MB

MD5
e13b02983d2d99c1657a5677868316d4

SHA1
738cbcd36e2cea3b3fcf1bdbe24adbba70ed15e1

SHA256
46a436a8e8c594424f3c570e11fab9070f16f67de064ebc830c82913aaf1d298

SHA512
7b54cbd5e7d1e8ac08bfbc4877862fc28071202fbc8a3c20245412a5eb16b48f7060cb4ef014c4d7781bd0af291997b3cebf93c3c37752b4ba603b0380219d6d

Download Submit
C:\Windows\system\LtuHqRy.exe

Filesize
1.9MB

MD5
7cc0637262b480a4f983e989ff0ab66e

SHA1
ef9398fd7ddad4d96ea0a1ad19ba2d014e5f0961

SHA256
3725ec6af945a5546f67e091884b71be3935fe9001f4542af10900e53e6f7f23

SHA512
aee7e8f0c912cdb66fd21183cd4adff5c83274e558ec4447d6cd8ebe9a92a7a267b90e99f0290f8f5f8a271570a09b4f6700608bb3c36d43dfa55cff01cfc210

Download Submit
C:\Windows\system\NxRgwub.exe

Filesize
1.9MB

MD5
0e4793c08ddf5e8baf860e9bfcee94d1

SHA1
e5864fd3a8906f0be8b1efd07551c643da27e88c

SHA256
434636850c4168b4d6692690a14b875578c4e9452a21f26554aa985874012690

SHA512
4e6d5254b1c46f982de0204b8d8fb4983bf4b8b54516ffe23b44bc1e0e85171020f01a4745fcac454e8f736eec07d9f3c5b8ddb3f1d4dd5c493c8a3f37d6c551

Download Submit
C:\Windows\system\OEWRMGh.exe

Filesize
1.9MB

MD5
c3659ecb2ee9b770fd357958accf5ef8

SHA1
5b121d956b6e4b9c70ad3fa73d85909a4728329c

SHA256
fd85120af5bc57f02a06f375f2695420ed915b2ea49ea020acec25f19ce6a215

SHA512
09fd06e3652bcdccab8ec0fe8253d495c17da70e8df319ba9f18f5305f00b45c7750cfac34559188d2424b52ef84a4c95d6fad363a0da183233a6fe55e0bbb8e

Download Submit
C:\Windows\system\OTQAZOS.exe

Filesize
1.9MB

MD5
79fb06aec21cbf88be44a08b29650ae4

SHA1
76536667a65629f843c1506dcac3e6e81406d638

SHA256
909cc332c6b0e22b3fbe61272c7bf61dcf50b58e1a7d354d2c5fdb3a9493fe98

SHA512
460193763f656a8707fe7169ad3b5edf6a312c8c11130b60f74d18b01f925e69b78947738ac5512d5651b05b043df0b79229e3567f29e51335c59dcfe2f89967

Download Submit
C:\Windows\system\PKgpkPI.exe

Filesize
1.9MB

MD5
52089ac9b0a311906129b68cca2eeefb

SHA1
c26744e7e0dd2262742c62e73c0cddf7f8a49291

SHA256
08d51d4e9c5cb0d66cea598cef6457e3ebf90e70e72301d252d1c1daabf8181d

SHA512
5f44fd69c813bb79b5622af5a103ae50befb6d4c0dc7189d8f5bcfb5161f0f431acccddc0b0e481c74544f76b320d2c525973f61889d7db27ebb9af1edabbce8

Download Submit
C:\Windows\system\PXWaHpd.exe

Filesize
1.9MB

MD5
a6074b6848aed4aca23e5d05f5deac3b

SHA1
6466e38db0c839054e860c838b23922f3b52dfa2

SHA256
402acbab60a79b928b9a4aeaed9d1353b928f3a9a502d6a1d95d721572baa7d5

SHA512
9ab13469fc0228ba792583aaf9180704a1021c4d918b760a139e54d5c29d6c9f80d09a3d2b3e60c70f8e8fe2318ddd08a913ee492b1372f046fcf2d0ab35631a

Download Submit
C:\Windows\system\QYVjWno.exe

Filesize
1.9MB

MD5
9bf95ab47aaff50f6dcec6aaf63da38f

SHA1
0537dc2cf2b3279f4e0f0a39bd530b00cdd23cc8

SHA256
638ab49af1c4ccc62bafbd46b69bf203d56afe77e413e83ab833f7a1d05a2873

SHA512
cdfa51c187fc8099c8e2aa2403f05efa8a445da183b9633fc56e458000c1991ed1a1e5f26e2726470a786ac23614b77839b73605a301e49ed611bf061fc83356

Download Submit
C:\Windows\system\UQfRfql.exe

Filesize
1.9MB

MD5
523c6a98fb39e386f7e7cd90a07cd250

SHA1
5914576d02884e833328133266640caff0a1abe5

SHA256
3146f3b684cc25bbd9a615034d638be3fa90e61d9833140bcda63176f70750f6

SHA512
a414139c30347e15d881e9736e11ed3de7458017d65a984784236524454c7403fb07a568a5ac14ae2e4c9e43565aae612811c5323c18bac66471ff57031af84f

Download Submit
C:\Windows\system\aTlUehp.exe

Filesize
1.9MB

MD5
69dc8b77dd346057163cfafadaeef506

SHA1
6e6d345f9cd6a87c1b7b6812fad49dfda60be704

SHA256
a1ae06e1a249b5750203a5ab8d27b50c3a1f5d7083f6950786ae1c7225d783c5

SHA512
fe7a79cfd29709b3f236162b23736f9bfdf57a24483bf2e966be4283926e31c4924752757b9a94b42c15a70df563a37a755d6269c2e59a9d73f714b301a6abd3

Download Submit
C:\Windows\system\bTlfTsX.exe

Filesize
1.9MB

MD5
3009e7b93596f8bc938db937895c2083

SHA1
c0d87362c1f7cffac5567748816ce3df355cc3cf

SHA256
d7eef71b9421605bce590b5f57d6ec11a3a9e568d43017c6896769193885776e

SHA512
6da90a9203b93596fd8b8d18a417b1ab2e7ba1045dc7d2cc2f7e748eef923bcd901493ae7c6e79f51272bae405825f0234010af20285d5ab4a8967f1affca084

Download Submit
C:\Windows\system\ejgUHxW.exe

Filesize
1.9MB

MD5
fb2b9b587adbdbc9fd5dd3124e420e35

SHA1
1994586b33c1e0d7b37e7ff20895f5762d34b5db

SHA256
808077ba746c5a263dbc41a5ca2c63324e8fe3ea17c71c3644a8576b862295e3

SHA512
4ca34cbe0e50ec74978b4aedac214931ab4abfe01e6bd0fe2b09f46d130f119f22e182755bf170291ab2b6c8159887cec50e59a3c0f36ffa20c25f9232f44d8c

Download Submit
C:\Windows\system\hvJKzDC.exe

Filesize
1.9MB

MD5
1c93ed36fd6b1fe44b9153a553fb24a2

SHA1
18338b7050939ad9db762ad7ba736ab7fd7311e5

SHA256
efdafb28e4e2904d3e9d578f6c4309155d0d81c3f82e26b4b0a1dc6c3f3ca101

SHA512
cefbba8f048aa60d7d0e78b2fca5c2685235becf7231c23b8b2cab0ee6fa440c96c2b6f9f45933c1d0fc97f9bacb7ee1efdd902326c97c2411579580c7b1d846

Download Submit
C:\Windows\system\jqMWnEa.exe

Filesize
1.9MB

MD5
ca095ab402b98c9b6f17a6d673edc69b

SHA1
ce31dfe729a18d73db80c82db6d33bf2365bf19f

SHA256
0ebb10be17f856df792f64bab1e21e6ccd4250a2c90758c208c355f63310fd22

SHA512
fd3ba8c8c53a78282d6e31e7ad09118496f5bee034c9690457b71e4a67ff1c8715a0cac0a765f1ca90ec666be2dc496e3938431b88cf3732cb45781c4d79b2d3

Download Submit
C:\Windows\system\lAizDrD.exe

Filesize
1.9MB

MD5
04df91dfe8bbab3c10e286c67707604a

SHA1
17d0d5cba7c903d5704c74683f9a42914d4b7a6a

SHA256
b1f97b89f4b0c443586d55d97a5e05b6301f93ab51562154ca733b92e8bfa8a6

SHA512
bac9fca49b77a54f1d118581793ceb0a1695726445232fafd820bb7839200fb45cbc25132067d3b3b93268dc12a7ba089f25d15ce86609833c397aad4bd804e1

Download Submit
C:\Windows\system\nDGzIeV.exe

Filesize
1.9MB

MD5
e0efb10edc08f7d361b729f53fe6bfbb

SHA1
d9c0b2bbfc6a56e3761743cf59d0efe7ac1f1bfa

SHA256
0835d8ea20cbb774f626407030f142a17a32b5b986d31b32ec19dfbee4c28dbb

SHA512
c114d58dbd6ab5a86aafacff697bbe1e06e9390ac260cf48a7fc5418d8084ca04c3e2e1f99a0b2d079279bb0ff301896061cbdf3d5eba29a2be73b294af0c465

Download Submit
C:\Windows\system\pIRblxd.exe

Filesize
1.9MB

MD5
ccb9d2ff76032d1b82a9e14783b7e9a6

SHA1
b1249e7e16afd13ee58c35d5da4b7ca5e91aee83

SHA256
0d5f71ae4fef38ad7a3d912730c520c76192159619986bf801eb81574e85dc08

SHA512
575376f1d2ea4e735265a465f85c50287863d3d62e0466573670b418dd2acc55d96116600f7b570370864dac8ce3b6e116562b7f8f1965f748c3506346fb4f56

Download Submit
C:\Windows\system\qYjEVOY.exe

Filesize
1.9MB

MD5
d96008e4820717adb26809ca064fc74b

SHA1
daeb97a59de760e0b160fcccba1f8a829769a140

SHA256
e60dce11767607a37f2988b78bae441f32c4e9dc57387b4bc3e199fbc7e0861e

SHA512
0f1739e748bd1531e305247a5e2cae3c4c0140bb7382abb12eac75363a5d20154cdf3b657825a1e77b501e84f9354b12ffef5ab55e4252a79a3bf5b6f1dd18a3

Download Submit
C:\Windows\system\rFhgIYf.exe

Filesize
1.9MB

MD5
b2c21e666e6f53c086f1c06d36b6fceb

SHA1
d75d67707fbca977b56d1d4bd9c5569c482fa136

SHA256
f908734e1f765f5fd77fe814018a2aa12ffd50c836186f2577d235aa9a1525a6

SHA512
d0e97f32bef27f7c8a20f95310d535d24b7b3981e0d386d9f2f87581be55021280dcc729bf455853567bc770727e3b9988e9c1432a4182fc256687eb1682ef17

Download Submit
C:\Windows\system\vdBkzAs.exe

Filesize
1.9MB

MD5
f7b253b1fe284a54f6feb9d23f289ea1

SHA1
5b78ba49b95ec3351510d3e95857db73abcf385f

SHA256
84f97016f8635ad47fe2aa46d4482f40d79569b6184df71302e17fd3523feed6

SHA512
d27163643ea4e78f801e1d0951d395cc8d674058afe74dcf580ee653687350e1ae0659d0c9cd6cd827b176b941f57dadc150dacc4230a9588ee9a00165577857

Download Submit
C:\Windows\system\vyRjbii.exe

Filesize
1.9MB

MD5
2302f5d9715c0038d617f18cb1537dfa

SHA1
38bc6f039ec25bf5b714ed0f47e16ad5989660a8

SHA256
1346e7fef1ea7fb97043a03e4af4b1c0239d79175ec06846616b66fc89979a14

SHA512
61a8930b8e1791687130ef2ebadc0560aa46e4659213428c7c85e3fb15959bf3020d0f8db268cc8863c7efd33f85cfa440c75621100dd7d5488f7aeb6d2cf0f3

Download Submit
\Windows\system\HWdeFjT.exe

Filesize
1.1MB

MD5
a093996abe7835e88584180c57950227

SHA1
f5920a542348decd0056be3a87a1ebc9c3386a7e

SHA256
93daf8ef56540f6302ad2d84984497e4b8556382a87ce404daadbc7c57d91d3e

SHA512
1242dd7797f9ae6b8802e7416446c32b2e7b0547d149b48b7c9a2d2c3f7931daf0de7c76d0b42629f664b31654b498df0ac76a74be79956db543888d1af56c75

Download Submit
\Windows\system\eAqQyxf.exe

Filesize
1.9MB

MD5
4cf9aa1a2c86a32741ae24326bcae636

SHA1
db71967e717eca7635b56b8b034df15fe8cd1dd6

SHA256
8b14b8c7c7237affd8f23ab0136d3342cec8e8ac92b8448b0b9e88093acec26a

SHA512
3912918dc095e90b9917d425040bd4824cce4b751034b9d5dc6c06780b1bd011f4b5c8d6557e3873a2133490883f93e0fbc5e065068399876eb72942018563fa

Download Submit
\Windows\system\semypbn.exe

Filesize
1.9MB

MD5
820d82c9b6bd3d038375c9ff50ae4c83

SHA1
34aae1668bb743e8493fc024bb8c4b3bfd6359bc

SHA256
00c7cb6e74817b4a4125fbe8ee602b54842b9c02ef570f767c2ce4597c09ac0f

SHA512
e1c5a40ee7c16836b990ba0f33309a6e089b16fddd890e5aad3351ed2b92075b2d554dc86d91b0dae65c34189666be3dc64074fc5a562bcf3cd44def6aa10e9b

Download Submit
\Windows\system\ujBGKNe.exe

Filesize
1.9MB

MD5
9a6099dca98c1df8b0c4e86c55eabd3c

SHA1
b2b76116fd9521d76a805db7bc44e8138a0a4e94

SHA256
9d3734e6349378061bcaa305d2bf728798c69fc2a1e348ea0371c15bedb1c09c

SHA512
aafae0648eb39cf065c640615b9ccd0e1233c0377c4f009942b325245f02ed6f97021068fa97a1ac778a290cbd6d10323755b21a92b39338409baba1e6ffda17

Download Submit
\Windows\system\vdBkzAs.exe

Filesize
1.8MB

MD5
481d028534e82a4ec954575cfcae44f8

SHA1
3a2cf7a9847d360a63374f21236e90771e5961b5

SHA256
37b836ec74fa47401e5af0fe819d7f69fe8bb4710815b911e63a7f1e4e0aaf26

SHA512
8168058dc40f92adad47313c1cb84a2bb9a43d557001cc8a8a3ad36bc8dd4a771efd9939e8eace2a5e3774cd515a7b968ec9ed8e36a1bb0a52658d9d9c4a7d9c

Download Submit
memory/1916-3056-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-96-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-26-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-1803-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2200-88-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2200-3081-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2340-2938-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2340-72-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2408-2509-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2408-80-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2428-56-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-2508-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-3026-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2488-78-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2504-81-0x00000000031F0000-0x00000000035E2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2504-0-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-38-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-8-0x0000000002DA0000-0x0000000003192000-memory.dmp

Filesize
3.9MB

Download
memory/2504-86-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-52-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-31-0x0000000002DA0000-0x0000000003192000-memory.dmp

Filesize
3.9MB

Download
memory/2504-20-0x0000000002DA0000-0x0000000003192000-memory.dmp

Filesize
3.9MB

Download
memory/2504-70-0x00000000031F0000-0x00000000035E2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-303-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-61-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2504-50-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2504-79-0x00000000031F0000-0x00000000035E2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-1786-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2516-24-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2652-33-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2652-1788-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2768-1789-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-9-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2840-41-0x000000001B330000-0x000000001B612000-memory.dmp

Filesize
2.9MB

Download
memory/2840-42-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Filesize
32KB

Download
memory/2888-62-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2888-2473-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2964-40-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-308-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-1888-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download