xmrig | f2fa0986ddb74be44276dd72c82d9008a9350847240b39f0bc49002bbaf9d32d

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
Size

1.7MB
MD5

17736b8bceed311df23ad5901fe8a167
SHA1

2896000a1aa73dd7ac94432a4401fb82600f8dbf
SHA256

f2fa0986ddb74be44276dd72c82d9008a9350847240b39f0bc49002bbaf9d32d
SHA512

a13d671fc50681f45e908bf8f898bf94e6f9953b7acb03a9f88471a3c136d803bafe91645cf34695fa49476168955e427998f0eac148cd051e13995397472f7f
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtq:Lz071uv4BPMkibTIA5I4TNrpDGgDQzK

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/2156-6-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2156-20-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2260-15-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2156-1481-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2576-4174-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/1796-4187-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2284-4195-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/1572-4179-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2260-4192-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2788-4190-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2568-4183-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2804-4170-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/1856-4166-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1840	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1796	fsykfIw.exe
2260	XPandJk.exe
1856	AFgfbJQ.exe
2788	OPiKVnD.exe
1572	cBqTnGl.exe
2568	pwcDRAA.exe
2804	YjicZsp.exe
2576	OLkSUvF.exe
2284	YOZTwNS.exe
2544	RWQEoly.exe
2492	KUgaWkS.exe
2640	CMGYPNv.exe
2364	rxwPhhf.exe
2484	gRtJISq.exe
2888	pNXGKzA.exe
2748	NbCJENU.exe
2044	thyKcpc.exe
1864	mLZersE.exe
2736	aDXYNwu.exe
1628	vlPlvWP.exe
752	SfvGpNB.exe
2368	SIRFNkA.exe
2876	sSNfVmO.exe
1720	miHQWRl.exe
932	jhhMvIb.exe
836	KEHsyQm.exe
1532	CKeMaDh.exe
2404	TBnGFKx.exe
2392	pRAlTUZ.exe
2424	ibHzuDU.exe
2420	bPpSoKx.exe
1676	kkLtsqS.exe
556	aTvhrPJ.exe
2452	CJCTLjW.exe
2724	XuRLRiM.exe
2820	rlQHKPq.exe
1944	JcWxorw.exe
1780	tfJRChN.exe
2252	FpAnBPL.exe
384	BCZJORo.exe
532	FJrCxLA.exe
1876	qLaklWE.exe
652	nRrRSWu.exe
1544	eUUpshR.exe
564	nZNGtXI.exe
1380	rPJlwNx.exe
608	XWHpVlN.exe
2968	XqeShZJ.exe
876	jhqVSOB.exe
2848	EufPuAL.exe
2072	AGssfne.exe
1284	PWgfqqZ.exe
1712	RNGkRis.exe
868	LOgBUJJ.exe
3008	mZDLevz.exe
2496	ltWHvvr.exe
2376	zTHhhGd.exe
1060	xqzYcng.exe
2592	XTNwNCG.exe
1648	rwZJuxO.exe
2924	zhdVVUr.exe
1100	gGuwPTm.exe
1696	IysWsHY.exe
2456	WRhuXhM.exe

Loads dropped DLL 64 IoCs

pid	Process
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000122cd-2.dat	upx
behavioral1/files/0x000a000000013a45-10.dat	upx
behavioral1/files/0x0008000000014185-9.dat	upx
behavioral1/memory/2156-6-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/files/0x0006000000015d79-188.dat	upx
behavioral1/files/0x0006000000015fe9-174.dat	upx
behavioral1/files/0x0006000000015eaf-168.dat	upx
behavioral1/files/0x0006000000015d9b-159.dat	upx
behavioral1/files/0x0006000000015d67-155.dat	upx
behavioral1/files/0x0006000000015d56-154.dat	upx
behavioral1/files/0x0006000000015d07-153.dat	upx
behavioral1/files/0x0006000000015ce1-152.dat	upx
behavioral1/files/0x0006000000015cba-151.dat	upx
behavioral1/files/0x0006000000015be6-150.dat	upx
behavioral1/files/0x0006000000015d87-146.dat	upx
behavioral1/files/0x0006000000015d6f-130.dat	upx
behavioral1/files/0x0006000000015d5e-124.dat	upx
behavioral1/files/0x0006000000015d28-118.dat	upx
behavioral1/memory/2284-113-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x0006000000015ceb-110.dat	upx
behavioral1/files/0x0006000000014baa-104.dat	upx
behavioral1/files/0x0006000000015cd5-102.dat	upx
behavioral1/memory/2804-97-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/files/0x0006000000015ca6-95.dat	upx
behavioral1/files/0x0008000000014b27-90.dat	upx
behavioral1/files/0x000600000001568c-87.dat	upx
behavioral1/memory/2788-79-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/files/0x000600000001566b-78.dat	upx
behavioral1/memory/1856-73-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/files/0x0006000000015659-71.dat	upx
behavioral1/files/0x000800000001420f-67.dat	upx
behavioral1/files/0x000600000001508a-64.dat	upx
behavioral1/files/0x0006000000014e51-181.dat	upx
behavioral1/files/0x0006000000016117-177.dat	upx
behavioral1/files/0x0006000000015f6d-171.dat	upx
behavioral1/files/0x0006000000015e3a-165.dat	upx
behavioral1/files/0x0006000000015d8f-156.dat	upx
behavioral1/files/0x000600000001567f-145.dat	upx
behavioral1/files/0x0006000000015661-143.dat	upx
behavioral1/files/0x0006000000015653-142.dat	upx
behavioral1/memory/2568-92-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/1572-86-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x0007000000014318-85.dat	upx
behavioral1/files/0x0006000000014f71-62.dat	upx
behavioral1/files/0x0006000000014bea-61.dat	upx
behavioral1/files/0x0006000000014b63-60.dat	upx
behavioral1/files/0x000700000001432c-59.dat	upx
behavioral1/files/0x000700000001424e-58.dat	upx
behavioral1/memory/2156-53-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/1796-34-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2260-15-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2156-1481-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2576-4174-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/1796-4187-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2284-4195-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/1572-4179-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2260-4192-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2788-4190-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2568-4183-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2804-4170-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/1856-4166-0x000000013FC60000-0x0000000140052000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yJFxiHn.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\EaZyWID.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\reDUxuN.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\Fjqrhfz.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\MibjVeJ.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\nXhWOGI.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\qayRsSL.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\kXeWIdc.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\PuFHyVq.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\QIIVQdE.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\ZnUqdCy.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\RCEObZt.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\sYxaPaP.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\WdjUDuF.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\LqNqqyS.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\qftWIoB.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\yXYUCiu.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\QTOQDZN.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\zJSMwvQ.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\dyQGsWR.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\UPBDtPl.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\JqPRDyJ.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\yaTKslm.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\fjdkzHO.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\XosUJeF.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\zcOnbWa.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\USttTyO.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\IRKXzzM.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\oTCBkih.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\DuVjYQC.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\GdUuVxG.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\DpnSjzT.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\wCngxHB.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\wQqXRYS.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\EXpJbEh.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\mGGMxhA.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\zWWnNVM.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\AhPAhKJ.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\onyUgvd.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\NVrHoXA.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\YGTGigB.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\IgdpEGq.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\xYRrgAS.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\OEguXKN.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\BAlUuZe.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\pnCQfli.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\DdpGbGw.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\REIyYOo.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\hmKEpID.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\vrPoysP.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\AMahfSS.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\YvtimKB.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\HqDbgxk.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\pyXctoD.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\kztsdgL.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\AXTFVrU.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\VNHsdLN.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\dCgjRKB.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\pZVoMnc.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\ZhJNsdP.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\gmbywxX.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\CuYpZhh.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\rApigPX.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
File created	C:\Windows\System\LdpCEea.exe	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1840	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeLockMemoryPrivilege	19624	Process not Found
Token: SeLockMemoryPrivilege	19624	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1840	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	29
PID 2156 wrote to memory of 1840	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	29
PID 2156 wrote to memory of 1840	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	29
PID 2156 wrote to memory of 1796	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	30
PID 2156 wrote to memory of 1796	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	30
PID 2156 wrote to memory of 1796	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2260	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	31
PID 2156 wrote to memory of 2260	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	31
PID 2156 wrote to memory of 2260	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	31
PID 2156 wrote to memory of 1856	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	32
PID 2156 wrote to memory of 1856	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	32
PID 2156 wrote to memory of 1856	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2284	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2284	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2284	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2788	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2788	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2788	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2544	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	35
PID 2156 wrote to memory of 2544	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	35
PID 2156 wrote to memory of 2544	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	35
PID 2156 wrote to memory of 1572	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	36
PID 2156 wrote to memory of 1572	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	36
PID 2156 wrote to memory of 1572	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	36
PID 2156 wrote to memory of 2492	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2492	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2492	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2568	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2568	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2568	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2640	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2640	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2640	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2804	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	40
PID 2156 wrote to memory of 2804	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	40
PID 2156 wrote to memory of 2804	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	40
PID 2156 wrote to memory of 2368	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	41
PID 2156 wrote to memory of 2368	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	41
PID 2156 wrote to memory of 2368	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	41
PID 2156 wrote to memory of 2576	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	42
PID 2156 wrote to memory of 2576	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	42
PID 2156 wrote to memory of 2576	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	42
PID 2156 wrote to memory of 2404	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	43
PID 2156 wrote to memory of 2404	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	43
PID 2156 wrote to memory of 2404	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	43
PID 2156 wrote to memory of 2364	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	44
PID 2156 wrote to memory of 2364	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	44
PID 2156 wrote to memory of 2364	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	44
PID 2156 wrote to memory of 2392	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	45
PID 2156 wrote to memory of 2392	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	45
PID 2156 wrote to memory of 2392	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	45
PID 2156 wrote to memory of 2484	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	46
PID 2156 wrote to memory of 2484	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	46
PID 2156 wrote to memory of 2484	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	46
PID 2156 wrote to memory of 2424	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	47
PID 2156 wrote to memory of 2424	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	47
PID 2156 wrote to memory of 2424	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	47
PID 2156 wrote to memory of 2888	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	48
PID 2156 wrote to memory of 2888	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	48
PID 2156 wrote to memory of 2888	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	48
PID 2156 wrote to memory of 2420	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	49
PID 2156 wrote to memory of 2420	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	49
PID 2156 wrote to memory of 2420	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	49
PID 2156 wrote to memory of 2748	2156	17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17736b8bceed311df23ad5901fe8a167_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\System\fsykfIw.exe
  C:\Windows\System\fsykfIw.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\XPandJk.exe
  C:\Windows\System\XPandJk.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\AFgfbJQ.exe
  C:\Windows\System\AFgfbJQ.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\YOZTwNS.exe
  C:\Windows\System\YOZTwNS.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\OPiKVnD.exe
  C:\Windows\System\OPiKVnD.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\RWQEoly.exe
  C:\Windows\System\RWQEoly.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\cBqTnGl.exe
  C:\Windows\System\cBqTnGl.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\KUgaWkS.exe
  C:\Windows\System\KUgaWkS.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\pwcDRAA.exe
  C:\Windows\System\pwcDRAA.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\CMGYPNv.exe
  C:\Windows\System\CMGYPNv.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\YjicZsp.exe
  C:\Windows\System\YjicZsp.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\SIRFNkA.exe
  C:\Windows\System\SIRFNkA.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\OLkSUvF.exe
  C:\Windows\System\OLkSUvF.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\TBnGFKx.exe
  C:\Windows\System\TBnGFKx.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\rxwPhhf.exe
  C:\Windows\System\rxwPhhf.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\pRAlTUZ.exe
  C:\Windows\System\pRAlTUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\gRtJISq.exe
  C:\Windows\System\gRtJISq.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\ibHzuDU.exe
  C:\Windows\System\ibHzuDU.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\pNXGKzA.exe
  C:\Windows\System\pNXGKzA.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\bPpSoKx.exe
  C:\Windows\System\bPpSoKx.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\NbCJENU.exe
  C:\Windows\System\NbCJENU.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\kkLtsqS.exe
  C:\Windows\System\kkLtsqS.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\thyKcpc.exe
  C:\Windows\System\thyKcpc.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\aTvhrPJ.exe
  C:\Windows\System\aTvhrPJ.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\mLZersE.exe
  C:\Windows\System\mLZersE.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\CJCTLjW.exe
  C:\Windows\System\CJCTLjW.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\aDXYNwu.exe
  C:\Windows\System\aDXYNwu.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\XuRLRiM.exe
  C:\Windows\System\XuRLRiM.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\vlPlvWP.exe
  C:\Windows\System\vlPlvWP.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\JcWxorw.exe
  C:\Windows\System\JcWxorw.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\SfvGpNB.exe
  C:\Windows\System\SfvGpNB.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\tfJRChN.exe
  C:\Windows\System\tfJRChN.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\sSNfVmO.exe
  C:\Windows\System\sSNfVmO.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\FpAnBPL.exe
  C:\Windows\System\FpAnBPL.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\miHQWRl.exe
  C:\Windows\System\miHQWRl.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\BCZJORo.exe
  C:\Windows\System\BCZJORo.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\jhhMvIb.exe
  C:\Windows\System\jhhMvIb.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\FJrCxLA.exe
  C:\Windows\System\FJrCxLA.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\KEHsyQm.exe
  C:\Windows\System\KEHsyQm.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\qLaklWE.exe
  C:\Windows\System\qLaklWE.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\CKeMaDh.exe
  C:\Windows\System\CKeMaDh.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\nRrRSWu.exe
  C:\Windows\System\nRrRSWu.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\rlQHKPq.exe
  C:\Windows\System\rlQHKPq.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\eUUpshR.exe
  C:\Windows\System\eUUpshR.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\nZNGtXI.exe
  C:\Windows\System\nZNGtXI.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\rPJlwNx.exe
  C:\Windows\System\rPJlwNx.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\XWHpVlN.exe
  C:\Windows\System\XWHpVlN.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\XqeShZJ.exe
  C:\Windows\System\XqeShZJ.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\jhqVSOB.exe
  C:\Windows\System\jhqVSOB.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\EufPuAL.exe
  C:\Windows\System\EufPuAL.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\AGssfne.exe
  C:\Windows\System\AGssfne.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\PWgfqqZ.exe
  C:\Windows\System\PWgfqqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\RNGkRis.exe
  C:\Windows\System\RNGkRis.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\LOgBUJJ.exe
  C:\Windows\System\LOgBUJJ.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\mZDLevz.exe
  C:\Windows\System\mZDLevz.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\ltWHvvr.exe
  C:\Windows\System\ltWHvvr.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\zTHhhGd.exe
  C:\Windows\System\zTHhhGd.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\xqzYcng.exe
  C:\Windows\System\xqzYcng.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\XTNwNCG.exe
  C:\Windows\System\XTNwNCG.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\rwZJuxO.exe
  C:\Windows\System\rwZJuxO.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\zhdVVUr.exe
  C:\Windows\System\zhdVVUr.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\gGuwPTm.exe
  C:\Windows\System\gGuwPTm.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\IysWsHY.exe
  C:\Windows\System\IysWsHY.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\GAZwLWR.exe
  C:\Windows\System\GAZwLWR.exe
  2⤵
  PID:1848
- C:\Windows\System\WRhuXhM.exe
  C:\Windows\System\WRhuXhM.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\DHOwyEL.exe
  C:\Windows\System\DHOwyEL.exe
  2⤵
  PID:1664
- C:\Windows\System\DZdbMQI.exe
  C:\Windows\System\DZdbMQI.exe
  2⤵
  PID:588
- C:\Windows\System\XrBEnfn.exe
  C:\Windows\System\XrBEnfn.exe
  2⤵
  PID:2668
- C:\Windows\System\izHpVek.exe
  C:\Windows\System\izHpVek.exe
  2⤵
  PID:628
- C:\Windows\System\binduaF.exe
  C:\Windows\System\binduaF.exe
  2⤵
  PID:1776
- C:\Windows\System\tbFfDWZ.exe
  C:\Windows\System\tbFfDWZ.exe
  2⤵
  PID:1156
- C:\Windows\System\Aqytrol.exe
  C:\Windows\System\Aqytrol.exe
  2⤵
  PID:3032
- C:\Windows\System\RmyvHsr.exe
  C:\Windows\System\RmyvHsr.exe
  2⤵
  PID:2776
- C:\Windows\System\BhxrTyE.exe
  C:\Windows\System\BhxrTyE.exe
  2⤵
  PID:324
- C:\Windows\System\BbpPFvJ.exe
  C:\Windows\System\BbpPFvJ.exe
  2⤵
  PID:1928
- C:\Windows\System\FAYsiKC.exe
  C:\Windows\System\FAYsiKC.exe
  2⤵
  PID:1748
- C:\Windows\System\YlCzRFO.exe
  C:\Windows\System\YlCzRFO.exe
  2⤵
  PID:2336
- C:\Windows\System\hOsRnXx.exe
  C:\Windows\System\hOsRnXx.exe
  2⤵
  PID:904
- C:\Windows\System\fCJkSAM.exe
  C:\Windows\System\fCJkSAM.exe
  2⤵
  PID:2216
- C:\Windows\System\qketWST.exe
  C:\Windows\System\qketWST.exe
  2⤵
  PID:2344
- C:\Windows\System\ewWHNin.exe
  C:\Windows\System\ewWHNin.exe
  2⤵
  PID:2204
- C:\Windows\System\rJEaKtL.exe
  C:\Windows\System\rJEaKtL.exe
  2⤵
  PID:1504
- C:\Windows\System\vKPZcLR.exe
  C:\Windows\System\vKPZcLR.exe
  2⤵
  PID:1732
- C:\Windows\System\eARSKVU.exe
  C:\Windows\System\eARSKVU.exe
  2⤵
  PID:1596
- C:\Windows\System\KMbpVCH.exe
  C:\Windows\System\KMbpVCH.exe
  2⤵
  PID:2636
- C:\Windows\System\wyhXWwa.exe
  C:\Windows\System\wyhXWwa.exe
  2⤵
  PID:2632
- C:\Windows\System\detEeYD.exe
  C:\Windows\System\detEeYD.exe
  2⤵
  PID:2712
- C:\Windows\System\oHSuACD.exe
  C:\Windows\System\oHSuACD.exe
  2⤵
  PID:1036
- C:\Windows\System\dcCcrLs.exe
  C:\Windows\System\dcCcrLs.exe
  2⤵
  PID:2984
- C:\Windows\System\KCqAjsb.exe
  C:\Windows\System\KCqAjsb.exe
  2⤵
  PID:2400
- C:\Windows\System\BinRtHG.exe
  C:\Windows\System\BinRtHG.exe
  2⤵
  PID:2372
- C:\Windows\System\NVrHoXA.exe
  C:\Windows\System\NVrHoXA.exe
  2⤵
  PID:1184
- C:\Windows\System\RhpUfbz.exe
  C:\Windows\System\RhpUfbz.exe
  2⤵
  PID:1636
- C:\Windows\System\ysWDEnS.exe
  C:\Windows\System\ysWDEnS.exe
  2⤵
  PID:2460
- C:\Windows\System\MGGVnfb.exe
  C:\Windows\System\MGGVnfb.exe
  2⤵
  PID:912
- C:\Windows\System\hEbGeEe.exe
  C:\Windows\System\hEbGeEe.exe
  2⤵
  PID:1244
- C:\Windows\System\mYTlwKW.exe
  C:\Windows\System\mYTlwKW.exe
  2⤵
  PID:1996
- C:\Windows\System\RPIyimf.exe
  C:\Windows\System\RPIyimf.exe
  2⤵
  PID:280
- C:\Windows\System\opfZQQd.exe
  C:\Windows\System\opfZQQd.exe
  2⤵
  PID:2872
- C:\Windows\System\WprLJSM.exe
  C:\Windows\System\WprLJSM.exe
  2⤵
  PID:1476
- C:\Windows\System\pdEGkmn.exe
  C:\Windows\System\pdEGkmn.exe
  2⤵
  PID:1536
- C:\Windows\System\RLsXqKC.exe
  C:\Windows\System\RLsXqKC.exe
  2⤵
  PID:2688
- C:\Windows\System\oVgiUMs.exe
  C:\Windows\System\oVgiUMs.exe
  2⤵
  PID:3004
- C:\Windows\System\DIItmaL.exe
  C:\Windows\System\DIItmaL.exe
  2⤵
  PID:2684
- C:\Windows\System\qssvpTS.exe
  C:\Windows\System\qssvpTS.exe
  2⤵
  PID:1920
- C:\Windows\System\TMPfUpJ.exe
  C:\Windows\System\TMPfUpJ.exe
  2⤵
  PID:2904
- C:\Windows\System\NpsWErZ.exe
  C:\Windows\System\NpsWErZ.exe
  2⤵
  PID:1120
- C:\Windows\System\RArFXoF.exe
  C:\Windows\System\RArFXoF.exe
  2⤵
  PID:1752
- C:\Windows\System\QeeoXxi.exe
  C:\Windows\System\QeeoXxi.exe
  2⤵
  PID:1756
- C:\Windows\System\hoqqAbi.exe
  C:\Windows\System\hoqqAbi.exe
  2⤵
  PID:352
- C:\Windows\System\qduKhrp.exe
  C:\Windows\System\qduKhrp.exe
  2⤵
  PID:2096
- C:\Windows\System\VeWmStl.exe
  C:\Windows\System\VeWmStl.exe
  2⤵
  PID:884
- C:\Windows\System\XRukqVu.exe
  C:\Windows\System\XRukqVu.exe
  2⤵
  PID:2796
- C:\Windows\System\YXMbOpL.exe
  C:\Windows\System\YXMbOpL.exe
  2⤵
  PID:1884
- C:\Windows\System\tlnpxik.exe
  C:\Windows\System\tlnpxik.exe
  2⤵
  PID:1880
- C:\Windows\System\IVfYzkQ.exe
  C:\Windows\System\IVfYzkQ.exe
  2⤵
  PID:2244
- C:\Windows\System\znZTZxC.exe
  C:\Windows\System\znZTZxC.exe
  2⤵
  PID:2480
- C:\Windows\System\xGcPlbY.exe
  C:\Windows\System\xGcPlbY.exe
  2⤵
  PID:2932
- C:\Windows\System\zZibWHH.exe
  C:\Windows\System\zZibWHH.exe
  2⤵
  PID:2116
- C:\Windows\System\CoVRgSa.exe
  C:\Windows\System\CoVRgSa.exe
  2⤵
  PID:2240
- C:\Windows\System\iQtTuVr.exe
  C:\Windows\System\iQtTuVr.exe
  2⤵
  PID:1040
- C:\Windows\System\mYkArpz.exe
  C:\Windows\System\mYkArpz.exe
  2⤵
  PID:2388
- C:\Windows\System\jTPpjqa.exe
  C:\Windows\System\jTPpjqa.exe
  2⤵
  PID:1324
- C:\Windows\System\pUfXCjP.exe
  C:\Windows\System\pUfXCjP.exe
  2⤵
  PID:1872
- C:\Windows\System\AZDZKdo.exe
  C:\Windows\System\AZDZKdo.exe
  2⤵
  PID:2720
- C:\Windows\System\kCncwUx.exe
  C:\Windows\System\kCncwUx.exe
  2⤵
  PID:596
- C:\Windows\System\xLtwZNV.exe
  C:\Windows\System\xLtwZNV.exe
  2⤵
  PID:2896
- C:\Windows\System\rBAIqYk.exe
  C:\Windows\System\rBAIqYk.exe
  2⤵
  PID:992
- C:\Windows\System\KhxIZEU.exe
  C:\Windows\System\KhxIZEU.exe
  2⤵
  PID:1744
- C:\Windows\System\CdZYjyg.exe
  C:\Windows\System\CdZYjyg.exe
  2⤵
  PID:3016
- C:\Windows\System\pKxFtCJ.exe
  C:\Windows\System\pKxFtCJ.exe
  2⤵
  PID:2100
- C:\Windows\System\GMjChrO.exe
  C:\Windows\System\GMjChrO.exe
  2⤵
  PID:1296
- C:\Windows\System\RosWdiv.exe
  C:\Windows\System\RosWdiv.exe
  2⤵
  PID:1236
- C:\Windows\System\xKrCybL.exe
  C:\Windows\System\xKrCybL.exe
  2⤵
  PID:2572
- C:\Windows\System\fMmIubp.exe
  C:\Windows\System\fMmIubp.exe
  2⤵
  PID:2728
- C:\Windows\System\TajjdMx.exe
  C:\Windows\System\TajjdMx.exe
  2⤵
  PID:2560
- C:\Windows\System\ZQxNgEB.exe
  C:\Windows\System\ZQxNgEB.exe
  2⤵
  PID:2764
- C:\Windows\System\NVqwwLy.exe
  C:\Windows\System\NVqwwLy.exe
  2⤵
  PID:2780
- C:\Windows\System\wQGMVFH.exe
  C:\Windows\System\wQGMVFH.exe
  2⤵
  PID:2312
- C:\Windows\System\EknWaCv.exe
  C:\Windows\System\EknWaCv.exe
  2⤵
  PID:312
- C:\Windows\System\vpDqHvg.exe
  C:\Windows\System\vpDqHvg.exe
  2⤵
  PID:3068
- C:\Windows\System\PrWMQCQ.exe
  C:\Windows\System\PrWMQCQ.exe
  2⤵
  PID:2428
- C:\Windows\System\XDGiVCY.exe
  C:\Windows\System\XDGiVCY.exe
  2⤵
  PID:2268
- C:\Windows\System\pNeARzq.exe
  C:\Windows\System\pNeARzq.exe
  2⤵
  PID:1568
- C:\Windows\System\HWJzMbQ.exe
  C:\Windows\System\HWJzMbQ.exe
  2⤵
  PID:2536
- C:\Windows\System\zpBXaGL.exe
  C:\Windows\System\zpBXaGL.exe
  2⤵
  PID:1340
- C:\Windows\System\cvZDbqr.exe
  C:\Windows\System\cvZDbqr.exe
  2⤵
  PID:2988
- C:\Windows\System\RYzjmeC.exe
  C:\Windows\System\RYzjmeC.exe
  2⤵
  PID:2516
- C:\Windows\System\cLHDnPk.exe
  C:\Windows\System\cLHDnPk.exe
  2⤵
  PID:2836
- C:\Windows\System\AELhucx.exe
  C:\Windows\System\AELhucx.exe
  2⤵
  PID:784
- C:\Windows\System\ayBXaFU.exe
  C:\Windows\System\ayBXaFU.exe
  2⤵
  PID:1448
- C:\Windows\System\cVoJlUH.exe
  C:\Windows\System\cVoJlUH.exe
  2⤵
  PID:3092
- C:\Windows\System\YhgotrI.exe
  C:\Windows\System\YhgotrI.exe
  2⤵
  PID:3112
- C:\Windows\System\tRpwbYx.exe
  C:\Windows\System\tRpwbYx.exe
  2⤵
  PID:3132
- C:\Windows\System\RuzOlZg.exe
  C:\Windows\System\RuzOlZg.exe
  2⤵
  PID:3152
- C:\Windows\System\ncOsBWb.exe
  C:\Windows\System\ncOsBWb.exe
  2⤵
  PID:3172
- C:\Windows\System\lIbBkAd.exe
  C:\Windows\System\lIbBkAd.exe
  2⤵
  PID:3192
- C:\Windows\System\TnrAfpX.exe
  C:\Windows\System\TnrAfpX.exe
  2⤵
  PID:3212
- C:\Windows\System\LRuAabg.exe
  C:\Windows\System\LRuAabg.exe
  2⤵
  PID:3232
- C:\Windows\System\AurmvUT.exe
  C:\Windows\System\AurmvUT.exe
  2⤵
  PID:3252
- C:\Windows\System\zyBvuYC.exe
  C:\Windows\System\zyBvuYC.exe
  2⤵
  PID:3268
- C:\Windows\System\bHCSvUg.exe
  C:\Windows\System\bHCSvUg.exe
  2⤵
  PID:3284
- C:\Windows\System\NBPhVfO.exe
  C:\Windows\System\NBPhVfO.exe
  2⤵
  PID:3300
- C:\Windows\System\vkHtdxU.exe
  C:\Windows\System\vkHtdxU.exe
  2⤵
  PID:3324
- C:\Windows\System\ZgGjWjs.exe
  C:\Windows\System\ZgGjWjs.exe
  2⤵
  PID:3340
- C:\Windows\System\BVvZxSk.exe
  C:\Windows\System\BVvZxSk.exe
  2⤵
  PID:3356
- C:\Windows\System\aGttcTC.exe
  C:\Windows\System\aGttcTC.exe
  2⤵
  PID:3372
- C:\Windows\System\ZqogUWs.exe
  C:\Windows\System\ZqogUWs.exe
  2⤵
  PID:3396
- C:\Windows\System\ndUHXcV.exe
  C:\Windows\System\ndUHXcV.exe
  2⤵
  PID:3412
- C:\Windows\System\xAqjSTi.exe
  C:\Windows\System\xAqjSTi.exe
  2⤵
  PID:3428
- C:\Windows\System\mrHKqzC.exe
  C:\Windows\System\mrHKqzC.exe
  2⤵
  PID:3444
- C:\Windows\System\sYbePQo.exe
  C:\Windows\System\sYbePQo.exe
  2⤵
  PID:3460
- C:\Windows\System\ehbJMjl.exe
  C:\Windows\System\ehbJMjl.exe
  2⤵
  PID:3476
- C:\Windows\System\LIloOrP.exe
  C:\Windows\System\LIloOrP.exe
  2⤵
  PID:3492
- C:\Windows\System\wwiADQd.exe
  C:\Windows\System\wwiADQd.exe
  2⤵
  PID:3508
- C:\Windows\System\FXAUSwT.exe
  C:\Windows\System\FXAUSwT.exe
  2⤵
  PID:3524
- C:\Windows\System\qtbDcJn.exe
  C:\Windows\System\qtbDcJn.exe
  2⤵
  PID:3540
- C:\Windows\System\HSPtyaP.exe
  C:\Windows\System\HSPtyaP.exe
  2⤵
  PID:3556
- C:\Windows\System\YqmEMaG.exe
  C:\Windows\System\YqmEMaG.exe
  2⤵
  PID:3572
- C:\Windows\System\BHDpfHi.exe
  C:\Windows\System\BHDpfHi.exe
  2⤵
  PID:3588
- C:\Windows\System\SqKdIgi.exe
  C:\Windows\System\SqKdIgi.exe
  2⤵
  PID:3604
- C:\Windows\System\DFllNST.exe
  C:\Windows\System\DFllNST.exe
  2⤵
  PID:3620
- C:\Windows\System\vJvYwVW.exe
  C:\Windows\System\vJvYwVW.exe
  2⤵
  PID:3636
- C:\Windows\System\xMeiFJK.exe
  C:\Windows\System\xMeiFJK.exe
  2⤵
  PID:3652
- C:\Windows\System\ORsgiqQ.exe
  C:\Windows\System\ORsgiqQ.exe
  2⤵
  PID:3668
- C:\Windows\System\yzBflcc.exe
  C:\Windows\System\yzBflcc.exe
  2⤵
  PID:3684
- C:\Windows\System\RgQcNOa.exe
  C:\Windows\System\RgQcNOa.exe
  2⤵
  PID:3700
- C:\Windows\System\XyTCwvI.exe
  C:\Windows\System\XyTCwvI.exe
  2⤵
  PID:3720
- C:\Windows\System\DeIIquu.exe
  C:\Windows\System\DeIIquu.exe
  2⤵
  PID:3736
- C:\Windows\System\RNlwQTA.exe
  C:\Windows\System\RNlwQTA.exe
  2⤵
  PID:3752
- C:\Windows\System\qMgwvzy.exe
  C:\Windows\System\qMgwvzy.exe
  2⤵
  PID:3768
- C:\Windows\System\XMafFZj.exe
  C:\Windows\System\XMafFZj.exe
  2⤵
  PID:3784
- C:\Windows\System\NFvauhr.exe
  C:\Windows\System\NFvauhr.exe
  2⤵
  PID:3800
- C:\Windows\System\XEkCZku.exe
  C:\Windows\System\XEkCZku.exe
  2⤵
  PID:3816
- C:\Windows\System\lKMKftv.exe
  C:\Windows\System\lKMKftv.exe
  2⤵
  PID:3832
- C:\Windows\System\tgNIJxB.exe
  C:\Windows\System\tgNIJxB.exe
  2⤵
  PID:3848
- C:\Windows\System\jPPTslX.exe
  C:\Windows\System\jPPTslX.exe
  2⤵
  PID:3864
- C:\Windows\System\ztQwcvU.exe
  C:\Windows\System\ztQwcvU.exe
  2⤵
  PID:3880
- C:\Windows\System\ZtQVAzh.exe
  C:\Windows\System\ZtQVAzh.exe
  2⤵
  PID:3896
- C:\Windows\System\EDbrzEL.exe
  C:\Windows\System\EDbrzEL.exe
  2⤵
  PID:3912
- C:\Windows\System\CJVDKzK.exe
  C:\Windows\System\CJVDKzK.exe
  2⤵
  PID:3928
- C:\Windows\System\wuXYsnV.exe
  C:\Windows\System\wuXYsnV.exe
  2⤵
  PID:4044
- C:\Windows\System\OyLwpzy.exe
  C:\Windows\System\OyLwpzy.exe
  2⤵
  PID:2060
- C:\Windows\System\QEsOnvv.exe
  C:\Windows\System\QEsOnvv.exe
  2⤵
  PID:3024
- C:\Windows\System\BjvpUlo.exe
  C:\Windows\System\BjvpUlo.exe
  2⤵
  PID:2324
- C:\Windows\System\EbpJvSz.exe
  C:\Windows\System\EbpJvSz.exe
  2⤵
  PID:1312
- C:\Windows\System\EMZRKNk.exe
  C:\Windows\System\EMZRKNk.exe
  2⤵
  PID:2008
- C:\Windows\System\GkSaTsP.exe
  C:\Windows\System\GkSaTsP.exe
  2⤵
  PID:3124
- C:\Windows\System\NPgCZqr.exe
  C:\Windows\System\NPgCZqr.exe
  2⤵
  PID:3164
- C:\Windows\System\ECcamLY.exe
  C:\Windows\System\ECcamLY.exe
  2⤵
  PID:3148
- C:\Windows\System\CfzopJu.exe
  C:\Windows\System\CfzopJu.exe
  2⤵
  PID:3180
- C:\Windows\System\oleBZEs.exe
  C:\Windows\System\oleBZEs.exe
  2⤵
  PID:2412
- C:\Windows\System\hsCYNMa.exe
  C:\Windows\System\hsCYNMa.exe
  2⤵
  PID:1860
- C:\Windows\System\YtSgtWn.exe
  C:\Windows\System\YtSgtWn.exe
  2⤵
  PID:2892
- C:\Windows\System\XeqmFbJ.exe
  C:\Windows\System\XeqmFbJ.exe
  2⤵
  PID:320
- C:\Windows\System\uxhDWLE.exe
  C:\Windows\System\uxhDWLE.exe
  2⤵
  PID:2220
- C:\Windows\System\nhsIthT.exe
  C:\Windows\System\nhsIthT.exe
  2⤵
  PID:2384
- C:\Windows\System\VKMOIYN.exe
  C:\Windows\System\VKMOIYN.exe
  2⤵
  PID:2148
- C:\Windows\System\YQZwxTf.exe
  C:\Windows\System\YQZwxTf.exe
  2⤵
  PID:888
- C:\Windows\System\JWuqAyl.exe
  C:\Windows\System\JWuqAyl.exe
  2⤵
  PID:3248
- C:\Windows\System\nQQBZgc.exe
  C:\Windows\System\nQQBZgc.exe
  2⤵
  PID:3320
- C:\Windows\System\PuCLrVf.exe
  C:\Windows\System\PuCLrVf.exe
  2⤵
  PID:3280
- C:\Windows\System\hLbLAVk.exe
  C:\Windows\System\hLbLAVk.exe
  2⤵
  PID:3348
- C:\Windows\System\oqfoQfp.exe
  C:\Windows\System\oqfoQfp.exe
  2⤵
  PID:3336
- C:\Windows\System\pYNSqnQ.exe
  C:\Windows\System\pYNSqnQ.exe
  2⤵
  PID:3392
- C:\Windows\System\LdpCEea.exe
  C:\Windows\System\LdpCEea.exe
  2⤵
  PID:3404
- C:\Windows\System\sbicPNJ.exe
  C:\Windows\System\sbicPNJ.exe
  2⤵
  PID:3452
- C:\Windows\System\giwkZxi.exe
  C:\Windows\System\giwkZxi.exe
  2⤵
  PID:1656
- C:\Windows\System\PUzqQAv.exe
  C:\Windows\System\PUzqQAv.exe
  2⤵
  PID:3472
- C:\Windows\System\tmvjGVc.exe
  C:\Windows\System\tmvjGVc.exe
  2⤵
  PID:3520
- C:\Windows\System\Irvgyne.exe
  C:\Windows\System\Irvgyne.exe
  2⤵
  PID:3552
- C:\Windows\System\yaMqexq.exe
  C:\Windows\System\yaMqexq.exe
  2⤵
  PID:3584
- C:\Windows\System\PfhPuQQ.exe
  C:\Windows\System\PfhPuQQ.exe
  2⤵
  PID:3632
- C:\Windows\System\tasyZtI.exe
  C:\Windows\System\tasyZtI.exe
  2⤵
  PID:3664
- C:\Windows\System\cuauFbX.exe
  C:\Windows\System\cuauFbX.exe
  2⤵
  PID:3696
- C:\Windows\System\bXlsuuy.exe
  C:\Windows\System\bXlsuuy.exe
  2⤵
  PID:3732
- C:\Windows\System\LxiZCJR.exe
  C:\Windows\System\LxiZCJR.exe
  2⤵
  PID:3764
- C:\Windows\System\IUUaiAP.exe
  C:\Windows\System\IUUaiAP.exe
  2⤵
  PID:3796
- C:\Windows\System\HeXnnWU.exe
  C:\Windows\System\HeXnnWU.exe
  2⤵
  PID:3844
- C:\Windows\System\XfuxvHC.exe
  C:\Windows\System\XfuxvHC.exe
  2⤵
  PID:3856
- C:\Windows\System\KxpEIPC.exe
  C:\Windows\System\KxpEIPC.exe
  2⤵
  PID:3908
- C:\Windows\System\TqyGjPB.exe
  C:\Windows\System\TqyGjPB.exe
  2⤵
  PID:3952
- C:\Windows\System\BMLmaFu.exe
  C:\Windows\System\BMLmaFu.exe
  2⤵
  PID:3964
- C:\Windows\System\SxIvYkb.exe
  C:\Windows\System\SxIvYkb.exe
  2⤵
  PID:3984
- C:\Windows\System\YfTVgzu.exe
  C:\Windows\System\YfTVgzu.exe
  2⤵
  PID:4000
- C:\Windows\System\dkztGqY.exe
  C:\Windows\System\dkztGqY.exe
  2⤵
  PID:4012
- C:\Windows\System\YEsqPEp.exe
  C:\Windows\System\YEsqPEp.exe
  2⤵
  PID:4036
- C:\Windows\System\efDmqrH.exe
  C:\Windows\System\efDmqrH.exe
  2⤵
  PID:1248
- C:\Windows\System\BxIfHBF.exe
  C:\Windows\System\BxIfHBF.exe
  2⤵
  PID:3120
- C:\Windows\System\DIxFwxi.exe
  C:\Windows\System\DIxFwxi.exe
  2⤵
  PID:3920
- C:\Windows\System\pGIuYqM.exe
  C:\Windows\System\pGIuYqM.exe
  2⤵
  PID:4052
- C:\Windows\System\FtDSgUo.exe
  C:\Windows\System\FtDSgUo.exe
  2⤵
  PID:4076
- C:\Windows\System\glJtvWe.exe
  C:\Windows\System\glJtvWe.exe
  2⤵
  PID:4092
- C:\Windows\System\eYrUJYN.exe
  C:\Windows\System\eYrUJYN.exe
  2⤵
  PID:2432
- C:\Windows\System\mcrbgkO.exe
  C:\Windows\System\mcrbgkO.exe
  2⤵
  PID:3128
- C:\Windows\System\wNjcQGp.exe
  C:\Windows\System\wNjcQGp.exe
  2⤵
  PID:1792
- C:\Windows\System\xEJWlLB.exe
  C:\Windows\System\xEJWlLB.exe
  2⤵
  PID:3200
- C:\Windows\System\eAZKOtJ.exe
  C:\Windows\System\eAZKOtJ.exe
  2⤵
  PID:676
- C:\Windows\System\renqQfm.exe
  C:\Windows\System\renqQfm.exe
  2⤵
  PID:3244
- C:\Windows\System\kcIQvoD.exe
  C:\Windows\System\kcIQvoD.exe
  2⤵
  PID:3456
- C:\Windows\System\SwORoXA.exe
  C:\Windows\System\SwORoXA.exe
  2⤵
  PID:3972
- C:\Windows\System\VMWqYcQ.exe
  C:\Windows\System\VMWqYcQ.exe
  2⤵
  PID:4100
- C:\Windows\System\bFLHjrn.exe
  C:\Windows\System\bFLHjrn.exe
  2⤵
  PID:4116
- C:\Windows\System\MRbbCbt.exe
  C:\Windows\System\MRbbCbt.exe
  2⤵
  PID:4132
- C:\Windows\System\yOuhzry.exe
  C:\Windows\System\yOuhzry.exe
  2⤵
  PID:4148
- C:\Windows\System\RcXGtrF.exe
  C:\Windows\System\RcXGtrF.exe
  2⤵
  PID:4164
- C:\Windows\System\dSrfNkS.exe
  C:\Windows\System\dSrfNkS.exe
  2⤵
  PID:4180
- C:\Windows\System\bjeCTtj.exe
  C:\Windows\System\bjeCTtj.exe
  2⤵
  PID:4204
- C:\Windows\System\ZuiKKup.exe
  C:\Windows\System\ZuiKKup.exe
  2⤵
  PID:4220
- C:\Windows\System\STmppUc.exe
  C:\Windows\System\STmppUc.exe
  2⤵
  PID:4236
- C:\Windows\System\dEdEZKW.exe
  C:\Windows\System\dEdEZKW.exe
  2⤵
  PID:4252
- C:\Windows\System\lgyimRs.exe
  C:\Windows\System\lgyimRs.exe
  2⤵
  PID:4268
- C:\Windows\System\CBBTJLe.exe
  C:\Windows\System\CBBTJLe.exe
  2⤵
  PID:4284
- C:\Windows\System\gdidrfe.exe
  C:\Windows\System\gdidrfe.exe
  2⤵
  PID:4304
- C:\Windows\System\ygMTwgW.exe
  C:\Windows\System\ygMTwgW.exe
  2⤵
  PID:4324
- C:\Windows\System\jxNbpHA.exe
  C:\Windows\System\jxNbpHA.exe
  2⤵
  PID:4340
- C:\Windows\System\gqdATNN.exe
  C:\Windows\System\gqdATNN.exe
  2⤵
  PID:4356
- C:\Windows\System\gqnstao.exe
  C:\Windows\System\gqnstao.exe
  2⤵
  PID:4376
- C:\Windows\System\QtsSSXh.exe
  C:\Windows\System\QtsSSXh.exe
  2⤵
  PID:4392
- C:\Windows\System\eexgfFR.exe
  C:\Windows\System\eexgfFR.exe
  2⤵
  PID:4408
- C:\Windows\System\vhAVjFx.exe
  C:\Windows\System\vhAVjFx.exe
  2⤵
  PID:4424
- C:\Windows\System\cklDsUR.exe
  C:\Windows\System\cklDsUR.exe
  2⤵
  PID:4440
- C:\Windows\System\BbnSBwg.exe
  C:\Windows\System\BbnSBwg.exe
  2⤵
  PID:4460
- C:\Windows\System\spXwNYb.exe
  C:\Windows\System\spXwNYb.exe
  2⤵
  PID:4476
- C:\Windows\System\jFUDFgc.exe
  C:\Windows\System\jFUDFgc.exe
  2⤵
  PID:4492
- C:\Windows\System\cJJFSnK.exe
  C:\Windows\System\cJJFSnK.exe
  2⤵
  PID:4508
- C:\Windows\System\YJNYMoP.exe
  C:\Windows\System\YJNYMoP.exe
  2⤵
  PID:4528
- C:\Windows\System\jYSNpdF.exe
  C:\Windows\System\jYSNpdF.exe
  2⤵
  PID:4544
- C:\Windows\System\XFuZAAi.exe
  C:\Windows\System\XFuZAAi.exe
  2⤵
  PID:4560
- C:\Windows\System\VFyYKbe.exe
  C:\Windows\System\VFyYKbe.exe
  2⤵
  PID:4576
- C:\Windows\System\tHMwwWE.exe
  C:\Windows\System\tHMwwWE.exe
  2⤵
  PID:4592
- C:\Windows\System\lAuLqfn.exe
  C:\Windows\System\lAuLqfn.exe
  2⤵
  PID:4612
- C:\Windows\System\fVTIWga.exe
  C:\Windows\System\fVTIWga.exe
  2⤵
  PID:4628
- C:\Windows\System\lXMeJZE.exe
  C:\Windows\System\lXMeJZE.exe
  2⤵
  PID:4644
- C:\Windows\System\OHDAeYO.exe
  C:\Windows\System\OHDAeYO.exe
  2⤵
  PID:4660
- C:\Windows\System\YsTKVAB.exe
  C:\Windows\System\YsTKVAB.exe
  2⤵
  PID:4680
- C:\Windows\System\TcWoIJR.exe
  C:\Windows\System\TcWoIJR.exe
  2⤵
  PID:4696
- C:\Windows\System\rpqsXbC.exe
  C:\Windows\System\rpqsXbC.exe
  2⤵
  PID:4712
- C:\Windows\System\RPXkLrx.exe
  C:\Windows\System\RPXkLrx.exe
  2⤵
  PID:4728
- C:\Windows\System\zvPqeRz.exe
  C:\Windows\System\zvPqeRz.exe
  2⤵
  PID:4748
- C:\Windows\System\aXtXoyG.exe
  C:\Windows\System\aXtXoyG.exe
  2⤵
  PID:4768
- C:\Windows\System\KLBtAXC.exe
  C:\Windows\System\KLBtAXC.exe
  2⤵
  PID:4784
- C:\Windows\System\GwuDBpS.exe
  C:\Windows\System\GwuDBpS.exe
  2⤵
  PID:4800
- C:\Windows\System\rIqAwOV.exe
  C:\Windows\System\rIqAwOV.exe
  2⤵
  PID:4816
- C:\Windows\System\uQUAbyw.exe
  C:\Windows\System\uQUAbyw.exe
  2⤵
  PID:4836
- C:\Windows\System\yAUerDE.exe
  C:\Windows\System\yAUerDE.exe
  2⤵
  PID:4852
- C:\Windows\System\VgUHdbj.exe
  C:\Windows\System\VgUHdbj.exe
  2⤵
  PID:4872
- C:\Windows\System\cHeqAyv.exe
  C:\Windows\System\cHeqAyv.exe
  2⤵
  PID:4888
- C:\Windows\System\YiXggZY.exe
  C:\Windows\System\YiXggZY.exe
  2⤵
  PID:4904
- C:\Windows\System\rfutmZF.exe
  C:\Windows\System\rfutmZF.exe
  2⤵
  PID:4920
- C:\Windows\System\ionUhJe.exe
  C:\Windows\System\ionUhJe.exe
  2⤵
  PID:4940
- C:\Windows\System\hezwbwS.exe
  C:\Windows\System\hezwbwS.exe
  2⤵
  PID:4956
- C:\Windows\System\VxJmqxo.exe
  C:\Windows\System\VxJmqxo.exe
  2⤵
  PID:4972
- C:\Windows\System\rTsZCPi.exe
  C:\Windows\System\rTsZCPi.exe
  2⤵
  PID:4988
- C:\Windows\System\nzLrChf.exe
  C:\Windows\System\nzLrChf.exe
  2⤵
  PID:5004
- C:\Windows\System\gGlbWjm.exe
  C:\Windows\System\gGlbWjm.exe
  2⤵
  PID:5024
- C:\Windows\System\ARgZgWa.exe
  C:\Windows\System\ARgZgWa.exe
  2⤵
  PID:5040
- C:\Windows\System\PSMONiW.exe
  C:\Windows\System\PSMONiW.exe
  2⤵
  PID:5056
- C:\Windows\System\XAgMXxU.exe
  C:\Windows\System\XAgMXxU.exe
  2⤵
  PID:5076
- C:\Windows\System\sHgdTOT.exe
  C:\Windows\System\sHgdTOT.exe
  2⤵
  PID:5092
- C:\Windows\System\JLgSaXy.exe
  C:\Windows\System\JLgSaXy.exe
  2⤵
  PID:5108
- C:\Windows\System\PmCafTN.exe
  C:\Windows\System\PmCafTN.exe
  2⤵
  PID:844
- C:\Windows\System\XJsQOkq.exe
  C:\Windows\System\XJsQOkq.exe
  2⤵
  PID:4436
- C:\Windows\System\rohzANA.exe
  C:\Windows\System\rohzANA.exe
  2⤵
  PID:4060
- C:\Windows\System\DCjDRVZ.exe
  C:\Windows\System\DCjDRVZ.exe
  2⤵
  PID:5012
- C:\Windows\System\breNuvc.exe
  C:\Windows\System\breNuvc.exe
  2⤵
  PID:4736
- C:\Windows\System\NZrtoCE.exe
  C:\Windows\System\NZrtoCE.exe
  2⤵
  PID:4848
- C:\Windows\System\OmecYpN.exe
  C:\Windows\System\OmecYpN.exe
  2⤵
  PID:4952
- C:\Windows\System\fnZgypi.exe
  C:\Windows\System\fnZgypi.exe
  2⤵
  PID:3276
- C:\Windows\System\cYNzhCz.exe
  C:\Windows\System\cYNzhCz.exe
  2⤵
  PID:3888
- C:\Windows\System\ToWgOCT.exe
  C:\Windows\System\ToWgOCT.exe
  2⤵
  PID:3992
- C:\Windows\System\nyFeAmJ.exe
  C:\Windows\System\nyFeAmJ.exe
  2⤵
  PID:4088
- C:\Windows\System\TWgBIny.exe
  C:\Windows\System\TWgBIny.exe
  2⤵
  PID:4384
- C:\Windows\System\QeXfscd.exe
  C:\Windows\System\QeXfscd.exe
  2⤵
  PID:4484
- C:\Windows\System\uUOYfMM.exe
  C:\Windows\System\uUOYfMM.exe
  2⤵
  PID:4900
- C:\Windows\System\yaUpddq.exe
  C:\Windows\System\yaUpddq.exe
  2⤵
  PID:4032
- C:\Windows\System\QynMapw.exe
  C:\Windows\System\QynMapw.exe
  2⤵
  PID:4896
- C:\Windows\System\JuMyXrV.exe
  C:\Windows\System\JuMyXrV.exe
  2⤵
  PID:2656
- C:\Windows\System\JzFRaaw.exe
  C:\Windows\System\JzFRaaw.exe
  2⤵
  PID:3468
- C:\Windows\System\nEuiIwQ.exe
  C:\Windows\System\nEuiIwQ.exe
  2⤵
  PID:3616
- C:\Windows\System\JNSuFRO.exe
  C:\Windows\System\JNSuFRO.exe
  2⤵
  PID:3840
- C:\Windows\System\pflAAbs.exe
  C:\Windows\System\pflAAbs.exe
  2⤵
  PID:4112
- C:\Windows\System\ZggPxFQ.exe
  C:\Windows\System\ZggPxFQ.exe
  2⤵
  PID:4756
- C:\Windows\System\UtBoBqQ.exe
  C:\Windows\System\UtBoBqQ.exe
  2⤵
  PID:4832
- C:\Windows\System\CVqCMuG.exe
  C:\Windows\System\CVqCMuG.exe
  2⤵
  PID:5064
- C:\Windows\System\EzeHFrb.exe
  C:\Windows\System\EzeHFrb.exe
  2⤵
  PID:3308
- C:\Windows\System\oZMuCdh.exe
  C:\Windows\System\oZMuCdh.exe
  2⤵
  PID:3260
- C:\Windows\System\aaRGUwb.exe
  C:\Windows\System\aaRGUwb.exe
  2⤵
  PID:3580
- C:\Windows\System\CUHZCcp.exe
  C:\Windows\System\CUHZCcp.exe
  2⤵
  PID:4260
- C:\Windows\System\ZLOpniF.exe
  C:\Windows\System\ZLOpniF.exe
  2⤵
  PID:840
- C:\Windows\System\jLItmJV.exe
  C:\Windows\System\jLItmJV.exe
  2⤵
  PID:3828
- C:\Windows\System\MLEUSQq.exe
  C:\Windows\System\MLEUSQq.exe
  2⤵
  PID:4472
- C:\Windows\System\YWYWsjG.exe
  C:\Windows\System\YWYWsjG.exe
  2⤵
  PID:4192
- C:\Windows\System\dqGozMi.exe
  C:\Windows\System\dqGozMi.exe
  2⤵
  PID:3504
- C:\Windows\System\gsdQqEF.exe
  C:\Windows\System\gsdQqEF.exe
  2⤵
  PID:5088
- C:\Windows\System\CxFfNjk.exe
  C:\Windows\System\CxFfNjk.exe
  2⤵
  PID:4196
- C:\Windows\System\GUSFAQe.exe
  C:\Windows\System\GUSFAQe.exe
  2⤵
  PID:4404
- C:\Windows\System\SEWNrqT.exe
  C:\Windows\System\SEWNrqT.exe
  2⤵
  PID:4604
- C:\Windows\System\MjLlBfJ.exe
  C:\Windows\System\MjLlBfJ.exe
  2⤵
  PID:4568
- C:\Windows\System\lftVXGB.exe
  C:\Windows\System\lftVXGB.exe
  2⤵
  PID:4264
- C:\Windows\System\IMFOUPq.exe
  C:\Windows\System\IMFOUPq.exe
  2⤵
  PID:5020
- C:\Windows\System\rWekWsq.exe
  C:\Windows\System\rWekWsq.exe
  2⤵
  PID:4984
- C:\Windows\System\HyotZRR.exe
  C:\Windows\System\HyotZRR.exe
  2⤵
  PID:2396
- C:\Windows\System\ONTdlur.exe
  C:\Windows\System\ONTdlur.exe
  2⤵
  PID:4024
- C:\Windows\System\fvfcmah.exe
  C:\Windows\System\fvfcmah.exe
  2⤵
  PID:3204
- C:\Windows\System\dHDxAAw.exe
  C:\Windows\System\dHDxAAw.exe
  2⤵
  PID:4108
- C:\Windows\System\hmtHCeT.exe
  C:\Windows\System\hmtHCeT.exe
  2⤵
  PID:4276
- C:\Windows\System\SSKHZMG.exe
  C:\Windows\System\SSKHZMG.exe
  2⤵
  PID:1416
- C:\Windows\System\OWNKvHe.exe
  C:\Windows\System\OWNKvHe.exe
  2⤵
  PID:4348
- C:\Windows\System\qsZsMbw.exe
  C:\Windows\System\qsZsMbw.exe
  2⤵
  PID:4420
- C:\Windows\System\vZvGEJd.exe
  C:\Windows\System\vZvGEJd.exe
  2⤵
  PID:4140
- C:\Windows\System\dwRFCGa.exe
  C:\Windows\System\dwRFCGa.exe
  2⤵
  PID:3408
- C:\Windows\System\uPCNdLX.exe
  C:\Windows\System\uPCNdLX.exe
  2⤵
  PID:3612
- C:\Windows\System\ZGDhsBx.exe
  C:\Windows\System\ZGDhsBx.exe
  2⤵
  PID:3600
- C:\Windows\System\znnjxoT.exe
  C:\Windows\System\znnjxoT.exe
  2⤵
  PID:3824
- C:\Windows\System\yIOwMeV.exe
  C:\Windows\System\yIOwMeV.exe
  2⤵
  PID:2068
- C:\Windows\System\ogjFoDH.exe
  C:\Windows\System\ogjFoDH.exe
  2⤵
  PID:4320
- C:\Windows\System\YMaYVca.exe
  C:\Windows\System\YMaYVca.exe
  2⤵
  PID:4556
- C:\Windows\System\TdVuFsW.exe
  C:\Windows\System\TdVuFsW.exe
  2⤵
  PID:4720
- C:\Windows\System\PkIAHjs.exe
  C:\Windows\System\PkIAHjs.exe
  2⤵
  PID:4932
- C:\Windows\System\hHrTxug.exe
  C:\Windows\System\hHrTxug.exe
  2⤵
  PID:4124
- C:\Windows\System\IIFMDya.exe
  C:\Windows\System\IIFMDya.exe
  2⤵
  PID:2440
- C:\Windows\System\kzSdoxG.exe
  C:\Windows\System\kzSdoxG.exe
  2⤵
  PID:4068
- C:\Windows\System\mXjrKum.exe
  C:\Windows\System\mXjrKum.exe
  2⤵
  PID:4200
- C:\Windows\System\FixqBYy.exe
  C:\Windows\System\FixqBYy.exe
  2⤵
  PID:3440
- C:\Windows\System\SOCQZXu.exe
  C:\Windows\System\SOCQZXu.exe
  2⤵
  PID:4372
- C:\Windows\System\ZhJNsdP.exe
  C:\Windows\System\ZhJNsdP.exe
  2⤵
  PID:2680
- C:\Windows\System\GnDsqjE.exe
  C:\Windows\System\GnDsqjE.exe
  2⤵
  PID:4600
- C:\Windows\System\viIDRnR.exe
  C:\Windows\System\viIDRnR.exe
  2⤵
  PID:4708
- C:\Windows\System\tBnVnva.exe
  C:\Windows\System\tBnVnva.exe
  2⤵
  PID:4844
- C:\Windows\System\nNsgwit.exe
  C:\Windows\System\nNsgwit.exe
  2⤵
  PID:2180
- C:\Windows\System\OTLBKYO.exe
  C:\Windows\System\OTLBKYO.exe
  2⤵
  PID:1620
- C:\Windows\System\gXwwDEU.exe
  C:\Windows\System\gXwwDEU.exe
  2⤵
  PID:4176
- C:\Windows\System\qyPOaZR.exe
  C:\Windows\System\qyPOaZR.exe
  2⤵
  PID:4212
- C:\Windows\System\GwcEWyZ.exe
  C:\Windows\System\GwcEWyZ.exe
  2⤵
  PID:3264
- C:\Windows\System\OEFbYYn.exe
  C:\Windows\System\OEFbYYn.exe
  2⤵
  PID:4552
- C:\Windows\System\vheLmQN.exe
  C:\Windows\System\vheLmQN.exe
  2⤵
  PID:4652
- C:\Windows\System\vtihNRc.exe
  C:\Windows\System\vtihNRc.exe
  2⤵
  PID:4724
- C:\Windows\System\vLccKoU.exe
  C:\Windows\System\vLccKoU.exe
  2⤵
  PID:4352
- C:\Windows\System\iVdyVdO.exe
  C:\Windows\System\iVdyVdO.exe
  2⤵
  PID:1896
- C:\Windows\System\mKmNCdp.exe
  C:\Windows\System\mKmNCdp.exe
  2⤵
  PID:2320
- C:\Windows\System\RQAFgDa.exe
  C:\Windows\System\RQAFgDa.exe
  2⤵
  PID:5036
- C:\Windows\System\GnoOJsC.exe
  C:\Windows\System\GnoOJsC.exe
  2⤵
  PID:4764
- C:\Windows\System\uzASVPb.exe
  C:\Windows\System\uzASVPb.exe
  2⤵
  PID:3384
- C:\Windows\System\QrDvHZn.exe
  C:\Windows\System\QrDvHZn.exe
  2⤵
  PID:4072
- C:\Windows\System\JLUltqP.exe
  C:\Windows\System\JLUltqP.exe
  2⤵
  PID:4188
- C:\Windows\System\arAgiJL.exe
  C:\Windows\System\arAgiJL.exe
  2⤵
  PID:4128
- C:\Windows\System\gNLCanQ.exe
  C:\Windows\System\gNLCanQ.exe
  2⤵
  PID:5084
- C:\Windows\System\qwdMCFS.exe
  C:\Windows\System\qwdMCFS.exe
  2⤵
  PID:3184
- C:\Windows\System\bsuRiSS.exe
  C:\Windows\System\bsuRiSS.exe
  2⤵
  PID:2084
- C:\Windows\System\yoAcKWb.exe
  C:\Windows\System\yoAcKWb.exe
  2⤵
  PID:2124
- C:\Windows\System\RMBGqha.exe
  C:\Windows\System\RMBGqha.exe
  2⤵
  PID:4968
- C:\Windows\System\mpZMHMn.exe
  C:\Windows\System\mpZMHMn.exe
  2⤵
  PID:1252
- C:\Windows\System\jJMxuGe.exe
  C:\Windows\System\jJMxuGe.exe
  2⤵
  PID:3312
- C:\Windows\System\iVxSmjD.exe
  C:\Windows\System\iVxSmjD.exe
  2⤵
  PID:3960
- C:\Windows\System\zotyzFs.exe
  C:\Windows\System\zotyzFs.exe
  2⤵
  PID:5000
- C:\Windows\System\iCbSSHq.exe
  C:\Windows\System\iCbSSHq.exe
  2⤵
  PID:4672
- C:\Windows\System\XwpodpA.exe
  C:\Windows\System\XwpodpA.exe
  2⤵
  PID:4808
- C:\Windows\System\Zvxycsz.exe
  C:\Windows\System\Zvxycsz.exe
  2⤵
  PID:4948
- C:\Windows\System\oupQWQH.exe
  C:\Windows\System\oupQWQH.exe
  2⤵
  PID:4824
- C:\Windows\System\uZRliQI.exe
  C:\Windows\System\uZRliQI.exe
  2⤵
  PID:3424
- C:\Windows\System\usxNqFx.exe
  C:\Windows\System\usxNqFx.exe
  2⤵
  PID:2624
- C:\Windows\System\aXJihwr.exe
  C:\Windows\System\aXJihwr.exe
  2⤵
  PID:1716
- C:\Windows\System\EIXHqJO.exe
  C:\Windows\System\EIXHqJO.exe
  2⤵
  PID:5100
- C:\Windows\System\dUaMGzu.exe
  C:\Windows\System\dUaMGzu.exe
  2⤵
  PID:4704
- C:\Windows\System\ZtSnlZY.exe
  C:\Windows\System\ZtSnlZY.exe
  2⤵
  PID:4780
- C:\Windows\System\MmEYAgm.exe
  C:\Windows\System\MmEYAgm.exe
  2⤵
  PID:4156
- C:\Windows\System\WLbhKJq.exe
  C:\Windows\System\WLbhKJq.exe
  2⤵
  PID:5132
- C:\Windows\System\qQEnkzY.exe
  C:\Windows\System\qQEnkzY.exe
  2⤵
  PID:5152
- C:\Windows\System\jdGWXmp.exe
  C:\Windows\System\jdGWXmp.exe
  2⤵
  PID:5172
- C:\Windows\System\IDaPANr.exe
  C:\Windows\System\IDaPANr.exe
  2⤵
  PID:5188
- C:\Windows\System\uGRbbud.exe
  C:\Windows\System\uGRbbud.exe
  2⤵
  PID:5204
- C:\Windows\System\SlWkeSG.exe
  C:\Windows\System\SlWkeSG.exe
  2⤵
  PID:5220
- C:\Windows\System\RBBNwPl.exe
  C:\Windows\System\RBBNwPl.exe
  2⤵
  PID:5236
- C:\Windows\System\qJeonjs.exe
  C:\Windows\System\qJeonjs.exe
  2⤵
  PID:5252
- C:\Windows\System\iFGJiUJ.exe
  C:\Windows\System\iFGJiUJ.exe
  2⤵
  PID:5356
- C:\Windows\System\udIZBtS.exe
  C:\Windows\System\udIZBtS.exe
  2⤵
  PID:5372
- C:\Windows\System\cgwSoyD.exe
  C:\Windows\System\cgwSoyD.exe
  2⤵
  PID:5388
- C:\Windows\System\cFkSvMX.exe
  C:\Windows\System\cFkSvMX.exe
  2⤵
  PID:5404
- C:\Windows\System\qjgMOzS.exe
  C:\Windows\System\qjgMOzS.exe
  2⤵
  PID:5428
- C:\Windows\System\AznGHLx.exe
  C:\Windows\System\AznGHLx.exe
  2⤵
  PID:5444
- C:\Windows\System\kqEmMhn.exe
  C:\Windows\System\kqEmMhn.exe
  2⤵
  PID:5460
- C:\Windows\System\xpvYzrX.exe
  C:\Windows\System\xpvYzrX.exe
  2⤵
  PID:5480
- C:\Windows\System\ZlENVRd.exe
  C:\Windows\System\ZlENVRd.exe
  2⤵
  PID:5496
- C:\Windows\System\dadQChX.exe
  C:\Windows\System\dadQChX.exe
  2⤵
  PID:5512
- C:\Windows\System\xefmTTx.exe
  C:\Windows\System\xefmTTx.exe
  2⤵
  PID:5528
- C:\Windows\System\hDBPDyP.exe
  C:\Windows\System\hDBPDyP.exe
  2⤵
  PID:5544
- C:\Windows\System\yBadlqG.exe
  C:\Windows\System\yBadlqG.exe
  2⤵
  PID:5564
- C:\Windows\System\RobvqjC.exe
  C:\Windows\System\RobvqjC.exe
  2⤵
  PID:5580
- C:\Windows\System\jsNAnco.exe
  C:\Windows\System\jsNAnco.exe
  2⤵
  PID:5596
- C:\Windows\System\BeIIKSN.exe
  C:\Windows\System\BeIIKSN.exe
  2⤵
  PID:5612
- C:\Windows\System\SmZRKDX.exe
  C:\Windows\System\SmZRKDX.exe
  2⤵
  PID:5632
- C:\Windows\System\NEYGpFF.exe
  C:\Windows\System\NEYGpFF.exe
  2⤵
  PID:5648
- C:\Windows\System\MDMRhls.exe
  C:\Windows\System\MDMRhls.exe
  2⤵
  PID:5664
- C:\Windows\System\BpuwBHg.exe
  C:\Windows\System\BpuwBHg.exe
  2⤵
  PID:5680
- C:\Windows\System\MvwUBhv.exe
  C:\Windows\System\MvwUBhv.exe
  2⤵
  PID:5700
- C:\Windows\System\APZNGJK.exe
  C:\Windows\System\APZNGJK.exe
  2⤵
  PID:5716
- C:\Windows\System\pGZVLIt.exe
  C:\Windows\System\pGZVLIt.exe
  2⤵
  PID:5732
- C:\Windows\System\QxGnrHU.exe
  C:\Windows\System\QxGnrHU.exe
  2⤵
  PID:5764
- C:\Windows\System\yWWpOHM.exe
  C:\Windows\System\yWWpOHM.exe
  2⤵
  PID:5784
- C:\Windows\System\ZNaUUQi.exe
  C:\Windows\System\ZNaUUQi.exe
  2⤵
  PID:5800
- C:\Windows\System\NgJLdIb.exe
  C:\Windows\System\NgJLdIb.exe
  2⤵
  PID:5816
- C:\Windows\System\kantwmk.exe
  C:\Windows\System\kantwmk.exe
  2⤵
  PID:5832
- C:\Windows\System\zuKGUND.exe
  C:\Windows\System\zuKGUND.exe
  2⤵
  PID:5852
- C:\Windows\System\gKCsraF.exe
  C:\Windows\System\gKCsraF.exe
  2⤵
  PID:5868
- C:\Windows\System\XMAEZKX.exe
  C:\Windows\System\XMAEZKX.exe
  2⤵
  PID:5884
- C:\Windows\System\dZeRkeu.exe
  C:\Windows\System\dZeRkeu.exe
  2⤵
  PID:5904
- C:\Windows\System\SSPqUYN.exe
  C:\Windows\System\SSPqUYN.exe
  2⤵
  PID:5920
- C:\Windows\System\lOmKagt.exe
  C:\Windows\System\lOmKagt.exe
  2⤵
  PID:5936
- C:\Windows\System\eTASQyu.exe
  C:\Windows\System\eTASQyu.exe
  2⤵
  PID:5960
- C:\Windows\System\sxWSxeQ.exe
  C:\Windows\System\sxWSxeQ.exe
  2⤵
  PID:5976
- C:\Windows\System\LLlyMgV.exe
  C:\Windows\System\LLlyMgV.exe
  2⤵
  PID:5992
- C:\Windows\System\eXxffJG.exe
  C:\Windows\System\eXxffJG.exe
  2⤵
  PID:6008
- C:\Windows\System\gztuvEu.exe
  C:\Windows\System\gztuvEu.exe
  2⤵
  PID:6024
- C:\Windows\System\VIPOLOb.exe
  C:\Windows\System\VIPOLOb.exe
  2⤵
  PID:6040
- C:\Windows\System\oZNehMx.exe
  C:\Windows\System\oZNehMx.exe
  2⤵
  PID:6056
- C:\Windows\System\BvGDUrb.exe
  C:\Windows\System\BvGDUrb.exe
  2⤵
  PID:6072
- C:\Windows\System\UbzqXBX.exe
  C:\Windows\System\UbzqXBX.exe
  2⤵
  PID:6088
- C:\Windows\System\hOmoETH.exe
  C:\Windows\System\hOmoETH.exe
  2⤵
  PID:6104
- C:\Windows\System\IGtHMvv.exe
  C:\Windows\System\IGtHMvv.exe
  2⤵
  PID:6120
- C:\Windows\System\pOoAWpp.exe
  C:\Windows\System\pOoAWpp.exe
  2⤵
  PID:5124
- C:\Windows\System\XFYOHtD.exe
  C:\Windows\System\XFYOHtD.exe
  2⤵
  PID:5168
- C:\Windows\System\UXMTCle.exe
  C:\Windows\System\UXMTCle.exe
  2⤵
  PID:4248
- C:\Windows\System\NjDFCva.exe
  C:\Windows\System\NjDFCva.exe
  2⤵
  PID:5200
- C:\Windows\System\RHuXZfH.exe
  C:\Windows\System\RHuXZfH.exe
  2⤵
  PID:5184
- C:\Windows\System\vzpaQuj.exe
  C:\Windows\System\vzpaQuj.exe
  2⤵
  PID:5212
- C:\Windows\System\FmgckTM.exe
  C:\Windows\System\FmgckTM.exe
  2⤵
  PID:5232
- C:\Windows\System\NKPXwOJ.exe
  C:\Windows\System\NKPXwOJ.exe
  2⤵
  PID:5276
- C:\Windows\System\GYXzTRl.exe
  C:\Windows\System\GYXzTRl.exe
  2⤵
  PID:5284
- C:\Windows\System\dpwwMNS.exe
  C:\Windows\System\dpwwMNS.exe
  2⤵
  PID:5304
- C:\Windows\System\XcuOzab.exe
  C:\Windows\System\XcuOzab.exe
  2⤵
  PID:5320
- C:\Windows\System\SBdRJSo.exe
  C:\Windows\System\SBdRJSo.exe
  2⤵
  PID:5336
- C:\Windows\System\zLoJyXt.exe
  C:\Windows\System\zLoJyXt.exe
  2⤵
  PID:5364
- C:\Windows\System\VcWmftq.exe
  C:\Windows\System\VcWmftq.exe
  2⤵
  PID:5456
- C:\Windows\System\bkXpdhW.exe
  C:\Windows\System\bkXpdhW.exe
  2⤵
  PID:5524
- C:\Windows\System\NQXTYnA.exe
  C:\Windows\System\NQXTYnA.exe
  2⤵
  PID:5520
- C:\Windows\System\STtmyOO.exe
  C:\Windows\System\STtmyOO.exe
  2⤵
  PID:5556
- C:\Windows\System\SPtxZCj.exe
  C:\Windows\System\SPtxZCj.exe
  2⤵
  PID:5624
- C:\Windows\System\MBcYmVc.exe
  C:\Windows\System\MBcYmVc.exe
  2⤵
  PID:5696
- C:\Windows\System\syINMjO.exe
  C:\Windows\System\syINMjO.exe
  2⤵
  PID:6084
- C:\Windows\System\ANlQpyr.exe
  C:\Windows\System\ANlQpyr.exe
  2⤵
  PID:6160
- C:\Windows\System\apnoulh.exe
  C:\Windows\System\apnoulh.exe
  2⤵
  PID:6180
- C:\Windows\System\aDSeXqy.exe
  C:\Windows\System\aDSeXqy.exe
  2⤵
  PID:6196
- C:\Windows\System\rApigPX.exe
  C:\Windows\System\rApigPX.exe
  2⤵
  PID:6216
- C:\Windows\System\IqHHtYi.exe
  C:\Windows\System\IqHHtYi.exe
  2⤵
  PID:6232
- C:\Windows\System\KVEyvNC.exe
  C:\Windows\System\KVEyvNC.exe
  2⤵
  PID:6248
- C:\Windows\System\VCMFmtN.exe
  C:\Windows\System\VCMFmtN.exe
  2⤵
  PID:6264
- C:\Windows\System\UOJUSBZ.exe
  C:\Windows\System\UOJUSBZ.exe
  2⤵
  PID:6292
- C:\Windows\System\ngGIfQn.exe
  C:\Windows\System\ngGIfQn.exe
  2⤵
  PID:6308
- C:\Windows\System\zrnBBXb.exe
  C:\Windows\System\zrnBBXb.exe
  2⤵
  PID:6328
- C:\Windows\System\yOhhQtX.exe
  C:\Windows\System\yOhhQtX.exe
  2⤵
  PID:6344
- C:\Windows\System\oAgldtc.exe
  C:\Windows\System\oAgldtc.exe
  2⤵
  PID:6360
- C:\Windows\System\tiupZck.exe
  C:\Windows\System\tiupZck.exe
  2⤵
  PID:6376
- C:\Windows\System\rPzkREQ.exe
  C:\Windows\System\rPzkREQ.exe
  2⤵
  PID:6392
- C:\Windows\System\XebzQGR.exe
  C:\Windows\System\XebzQGR.exe
  2⤵
  PID:6408
- C:\Windows\System\KFBaNZB.exe
  C:\Windows\System\KFBaNZB.exe
  2⤵
  PID:6424
- C:\Windows\System\IDnLOSu.exe
  C:\Windows\System\IDnLOSu.exe
  2⤵
  PID:6440
- C:\Windows\System\DBjKWwh.exe
  C:\Windows\System\DBjKWwh.exe
  2⤵
  PID:6460
- C:\Windows\System\wIWgZfj.exe
  C:\Windows\System\wIWgZfj.exe
  2⤵
  PID:6476
- C:\Windows\System\wMEZLjq.exe
  C:\Windows\System\wMEZLjq.exe
  2⤵
  PID:6492
- C:\Windows\System\JvXGnMC.exe
  C:\Windows\System\JvXGnMC.exe
  2⤵
  PID:6508
- C:\Windows\System\afVNcOa.exe
  C:\Windows\System\afVNcOa.exe
  2⤵
  PID:6524
- C:\Windows\System\sDekATI.exe
  C:\Windows\System\sDekATI.exe
  2⤵
  PID:6540
- C:\Windows\System\yogQuso.exe
  C:\Windows\System\yogQuso.exe
  2⤵
  PID:6556
- C:\Windows\System\laCbekv.exe
  C:\Windows\System\laCbekv.exe
  2⤵
  PID:6572
- C:\Windows\System\vuSPqxF.exe
  C:\Windows\System\vuSPqxF.exe
  2⤵
  PID:6588
- C:\Windows\System\ltnCURv.exe
  C:\Windows\System\ltnCURv.exe
  2⤵
  PID:6604
- C:\Windows\System\PZBVvkx.exe
  C:\Windows\System\PZBVvkx.exe
  2⤵
  PID:6620
- C:\Windows\System\jafDPVp.exe
  C:\Windows\System\jafDPVp.exe
  2⤵
  PID:6636
- C:\Windows\System\jiLFqNW.exe
  C:\Windows\System\jiLFqNW.exe
  2⤵
  PID:6652
- C:\Windows\System\dFsrXbv.exe
  C:\Windows\System\dFsrXbv.exe
  2⤵
  PID:6668
- C:\Windows\System\doPfZmq.exe
  C:\Windows\System\doPfZmq.exe
  2⤵
  PID:6684
- C:\Windows\System\EqlAkbt.exe
  C:\Windows\System\EqlAkbt.exe
  2⤵
  PID:6700
- C:\Windows\System\OehEdQj.exe
  C:\Windows\System\OehEdQj.exe
  2⤵
  PID:6716
- C:\Windows\System\ZrkMCkV.exe
  C:\Windows\System\ZrkMCkV.exe
  2⤵
  PID:6732
- C:\Windows\System\IilCZFn.exe
  C:\Windows\System\IilCZFn.exe
  2⤵
  PID:6748
- C:\Windows\System\qBimOHA.exe
  C:\Windows\System\qBimOHA.exe
  2⤵
  PID:6764
- C:\Windows\System\XILhMff.exe
  C:\Windows\System\XILhMff.exe
  2⤵
  PID:6780
- C:\Windows\System\GaFuEGv.exe
  C:\Windows\System\GaFuEGv.exe
  2⤵
  PID:6796
- C:\Windows\System\bZrGPpH.exe
  C:\Windows\System\bZrGPpH.exe
  2⤵
  PID:6816
- C:\Windows\System\qHDMSVD.exe
  C:\Windows\System\qHDMSVD.exe
  2⤵
  PID:6832
- C:\Windows\System\pcDvCtW.exe
  C:\Windows\System\pcDvCtW.exe
  2⤵
  PID:6848
- C:\Windows\System\hulDoQv.exe
  C:\Windows\System\hulDoQv.exe
  2⤵
  PID:6864
- C:\Windows\System\HetOyoP.exe
  C:\Windows\System\HetOyoP.exe
  2⤵
  PID:6880
- C:\Windows\System\XiNKEgb.exe
  C:\Windows\System\XiNKEgb.exe
  2⤵
  PID:6896
- C:\Windows\System\yjGecNr.exe
  C:\Windows\System\yjGecNr.exe
  2⤵
  PID:6912
- C:\Windows\System\KFqjItG.exe
  C:\Windows\System\KFqjItG.exe
  2⤵
  PID:6928
- C:\Windows\System\TPhLUUg.exe
  C:\Windows\System\TPhLUUg.exe
  2⤵
  PID:6944
- C:\Windows\System\SPXzvuL.exe
  C:\Windows\System\SPXzvuL.exe
  2⤵
  PID:6960
- C:\Windows\System\gfKDzEb.exe
  C:\Windows\System\gfKDzEb.exe
  2⤵
  PID:6976
- C:\Windows\System\DdUjhDM.exe
  C:\Windows\System\DdUjhDM.exe
  2⤵
  PID:6996
- C:\Windows\System\QuHqHEs.exe
  C:\Windows\System\QuHqHEs.exe
  2⤵
  PID:7012
- C:\Windows\System\ffZmZNA.exe
  C:\Windows\System\ffZmZNA.exe
  2⤵
  PID:7028
- C:\Windows\System\QTOQDZN.exe
  C:\Windows\System\QTOQDZN.exe
  2⤵
  PID:7044
- C:\Windows\System\wvIKyMq.exe
  C:\Windows\System\wvIKyMq.exe
  2⤵
  PID:7060
- C:\Windows\System\CrEyegW.exe
  C:\Windows\System\CrEyegW.exe
  2⤵
  PID:7076
- C:\Windows\System\PLnWsGP.exe
  C:\Windows\System\PLnWsGP.exe
  2⤵
  PID:7092
- C:\Windows\System\IiUQKzl.exe
  C:\Windows\System\IiUQKzl.exe
  2⤵
  PID:7108
- C:\Windows\System\qNmOcwR.exe
  C:\Windows\System\qNmOcwR.exe
  2⤵
  PID:7124
- C:\Windows\System\BochOQs.exe
  C:\Windows\System\BochOQs.exe
  2⤵
  PID:7140
- C:\Windows\System\qsRBBkl.exe
  C:\Windows\System\qsRBBkl.exe
  2⤵
  PID:7156
- C:\Windows\System\tMTveFm.exe
  C:\Windows\System\tMTveFm.exe
  2⤵
  PID:5128
- C:\Windows\System\cEZYhie.exe
  C:\Windows\System\cEZYhie.exe
  2⤵
  PID:5780
- C:\Windows\System\muyCkIT.exe
  C:\Windows\System\muyCkIT.exe
  2⤵
  PID:5880
- C:\Windows\System\hCGhirW.exe
  C:\Windows\System\hCGhirW.exe
  2⤵
  PID:3780
- C:\Windows\System\RauXGSr.exe
  C:\Windows\System\RauXGSr.exe
  2⤵
  PID:6016
- C:\Windows\System\TlhnuVI.exe
  C:\Windows\System\TlhnuVI.exe
  2⤵
  PID:5328
- C:\Windows\System\HORmVUO.exe
  C:\Windows\System\HORmVUO.exe
  2⤵
  PID:5488
- C:\Windows\System\EkZYpfe.exe
  C:\Windows\System\EkZYpfe.exe
  2⤵
  PID:5772
- C:\Windows\System\WHQNGBR.exe
  C:\Windows\System\WHQNGBR.exe
  2⤵
  PID:5948
- C:\Windows\System\AhPAhKJ.exe
  C:\Windows\System\AhPAhKJ.exe
  2⤵
  PID:5508
- C:\Windows\System\DezLQXh.exe
  C:\Windows\System\DezLQXh.exe
  2⤵
  PID:5468
- C:\Windows\System\DeOeQjw.exe
  C:\Windows\System\DeOeQjw.exe
  2⤵
  PID:5368
- C:\Windows\System\osPVlrY.exe
  C:\Windows\System\osPVlrY.exe
  2⤵
  PID:5576
- C:\Windows\System\YsygwpC.exe
  C:\Windows\System\YsygwpC.exe
  2⤵
  PID:6048
- C:\Windows\System\MtJTIkD.exe
  C:\Windows\System\MtJTIkD.exe
  2⤵
  PID:6116
- C:\Windows\System\CXOXHKG.exe
  C:\Windows\System\CXOXHKG.exe
  2⤵
  PID:5644
- C:\Windows\System\ZUEVyzE.exe
  C:\Windows\System\ZUEVyzE.exe
  2⤵
  PID:5712
- C:\Windows\System\wmtvGKh.exe
  C:\Windows\System\wmtvGKh.exe
  2⤵
  PID:6176
- C:\Windows\System\NHWpqcH.exe
  C:\Windows\System\NHWpqcH.exe
  2⤵
  PID:6276
- C:\Windows\System\mcxvWmI.exe
  C:\Windows\System\mcxvWmI.exe
  2⤵
  PID:5860
- C:\Windows\System\tqHEZWF.exe
  C:\Windows\System\tqHEZWF.exe
  2⤵
  PID:5900
- C:\Windows\System\LOapjHR.exe
  C:\Windows\System\LOapjHR.exe
  2⤵
  PID:5972
- C:\Windows\System\SXzWWQy.exe
  C:\Windows\System\SXzWWQy.exe
  2⤵
  PID:5688
- C:\Windows\System\Gqujbgy.exe
  C:\Windows\System\Gqujbgy.exe
  2⤵
  PID:5608
- C:\Windows\System\WSYhJks.exe
  C:\Windows\System\WSYhJks.exe
  2⤵
  PID:5752
- C:\Windows\System\GYqchye.exe
  C:\Windows\System\GYqchye.exe
  2⤵
  PID:6224
- C:\Windows\System\qWEvlPv.exe
  C:\Windows\System\qWEvlPv.exe
  2⤵
  PID:6032
- C:\Windows\System\kidlRPt.exe
  C:\Windows\System\kidlRPt.exe
  2⤵
  PID:6068
- C:\Windows\System\GworKDm.exe
  C:\Windows\System\GworKDm.exe
  2⤵
  PID:6140
- C:\Windows\System\aDlZFSd.exe
  C:\Windows\System\aDlZFSd.exe
  2⤵
  PID:3728
- C:\Windows\System\RZQKbPf.exe
  C:\Windows\System\RZQKbPf.exe
  2⤵
  PID:5248
- C:\Windows\System\JJtuJCX.exe
  C:\Windows\System\JJtuJCX.exe
  2⤵
  PID:5316
- C:\Windows\System\BZVMiQq.exe
  C:\Windows\System\BZVMiQq.exe
  2⤵
  PID:5424
- C:\Windows\System\dyZnXgp.exe
  C:\Windows\System\dyZnXgp.exe
  2⤵
  PID:5692
- C:\Windows\System\pnFksGq.exe
  C:\Windows\System\pnFksGq.exe
  2⤵
  PID:2700
- C:\Windows\System\iQvNXde.exe
  C:\Windows\System\iQvNXde.exe
  2⤵
  PID:6304
- C:\Windows\System\bNzzFAM.exe
  C:\Windows\System\bNzzFAM.exe
  2⤵
  PID:6336
- C:\Windows\System\rhArSZU.exe
  C:\Windows\System\rhArSZU.exe
  2⤵
  PID:6388
- C:\Windows\System\uINbzpH.exe
  C:\Windows\System\uINbzpH.exe
  2⤵
  PID:6448
- C:\Windows\System\mbUKLDK.exe
  C:\Windows\System\mbUKLDK.exe
  2⤵
  PID:6488
- C:\Windows\System\cewjhcJ.exe
  C:\Windows\System\cewjhcJ.exe
  2⤵
  PID:6372
- C:\Windows\System\OuGINWt.exe
  C:\Windows\System\OuGINWt.exe
  2⤵
  PID:6436
- C:\Windows\System\KuCMWrM.exe
  C:\Windows\System\KuCMWrM.exe
  2⤵
  PID:6504
- C:\Windows\System\tByMzgR.exe
  C:\Windows\System\tByMzgR.exe
  2⤵
  PID:6552
- C:\Windows\System\zFIujSF.exe
  C:\Windows\System\zFIujSF.exe
  2⤵
  PID:6584
- C:\Windows\System\YTounQW.exe
  C:\Windows\System\YTounQW.exe
  2⤵
  PID:6648
- C:\Windows\System\swbQTNc.exe
  C:\Windows\System\swbQTNc.exe
  2⤵
  PID:6596
- C:\Windows\System\NFUlxpF.exe
  C:\Windows\System\NFUlxpF.exe
  2⤵
  PID:6660
- C:\Windows\System\ryGdyYk.exe
  C:\Windows\System\ryGdyYk.exe
  2⤵
  PID:6696
- C:\Windows\System\uBYteFL.exe
  C:\Windows\System\uBYteFL.exe
  2⤵
  PID:6812
- C:\Windows\System\RrpKjCV.exe
  C:\Windows\System\RrpKjCV.exe
  2⤵
  PID:6872
- C:\Windows\System\lJGnWwA.exe
  C:\Windows\System\lJGnWwA.exe
  2⤵
  PID:6904
- C:\Windows\System\ImNdhMO.exe
  C:\Windows\System\ImNdhMO.exe
  2⤵
  PID:6860
- C:\Windows\System\awReQow.exe
  C:\Windows\System\awReQow.exe
  2⤵
  PID:6920
- C:\Windows\System\ZUlMChl.exe
  C:\Windows\System\ZUlMChl.exe
  2⤵
  PID:6972
- C:\Windows\System\cSZeRed.exe
  C:\Windows\System\cSZeRed.exe
  2⤵
  PID:6984
- C:\Windows\System\VqjbDVK.exe
  C:\Windows\System\VqjbDVK.exe
  2⤵
  PID:7036
- C:\Windows\System\zRitNqe.exe
  C:\Windows\System\zRitNqe.exe
  2⤵
  PID:7068
- C:\Windows\System\OoMHxvn.exe
  C:\Windows\System\OoMHxvn.exe
  2⤵
  PID:7132
- C:\Windows\System\UpuZLla.exe
  C:\Windows\System\UpuZLla.exe
  2⤵
  PID:7084
- C:\Windows\System\agymHiQ.exe
  C:\Windows\System\agymHiQ.exe
  2⤵
  PID:7148
- C:\Windows\System\SZqBhfO.exe
  C:\Windows\System\SZqBhfO.exe
  2⤵
  PID:5812
- C:\Windows\System\spcVvJG.exe
  C:\Windows\System\spcVvJG.exe
  2⤵
  PID:5848
- C:\Windows\System\jtWVmfX.exe
  C:\Windows\System\jtWVmfX.exe
  2⤵
  PID:5384
- C:\Windows\System\iWBIjru.exe
  C:\Windows\System\iWBIjru.exe
  2⤵
  PID:5476
- C:\Windows\System\GMaZcac.exe
  C:\Windows\System\GMaZcac.exe
  2⤵
  PID:6112
- C:\Windows\System\QyysObj.exe
  C:\Windows\System\QyysObj.exe
  2⤵
  PID:6272
- C:\Windows\System\HZxNvvd.exe
  C:\Windows\System\HZxNvvd.exe
  2⤵
  PID:6284
- C:\Windows\System\IrDypMT.exe
  C:\Windows\System\IrDypMT.exe
  2⤵
  PID:5756
- C:\Windows\System\dyikmGp.exe
  C:\Windows\System\dyikmGp.exe
  2⤵
  PID:5588
- C:\Windows\System\xylFLHO.exe
  C:\Windows\System\xylFLHO.exe
  2⤵
  PID:5436
- C:\Windows\System\USEebHB.exe
  C:\Windows\System\USEebHB.exe
  2⤵
  PID:6212
- C:\Windows\System\IquGKhK.exe
  C:\Windows\System\IquGKhK.exe
  2⤵
  PID:6316
- C:\Windows\System\VxOOIIl.exe
  C:\Windows\System\VxOOIIl.exe
  2⤵
  PID:6132
- C:\Windows\System\SjuGpuP.exe
  C:\Windows\System\SjuGpuP.exe
  2⤵
  PID:5968
- C:\Windows\System\RTlLmpW.exe
  C:\Windows\System\RTlLmpW.exe
  2⤵
  PID:4448
- C:\Windows\System\WlJhMyZ.exe
  C:\Windows\System\WlJhMyZ.exe
  2⤵
  PID:4520
- C:\Windows\System\VmwYhPl.exe
  C:\Windows\System\VmwYhPl.exe
  2⤵
  PID:6260
- C:\Windows\System\fbNtAfb.exe
  C:\Windows\System\fbNtAfb.exe
  2⤵
  PID:6288
- C:\Windows\System\SsfiuKb.exe
  C:\Windows\System\SsfiuKb.exe
  2⤵
  PID:5312
- C:\Windows\System\gqQqFPy.exe
  C:\Windows\System\gqQqFPy.exe
  2⤵
  PID:5628
- C:\Windows\System\XZqDUKf.exe
  C:\Windows\System\XZqDUKf.exe
  2⤵
  PID:6484
- C:\Windows\System\pUZrhpv.exe
  C:\Windows\System\pUZrhpv.exe
  2⤵
  PID:6472
- C:\Windows\System\eufybzk.exe
  C:\Windows\System\eufybzk.exe
  2⤵
  PID:6548
- C:\Windows\System\obsSFgw.exe
  C:\Windows\System\obsSFgw.exe
  2⤵
  PID:6692
- C:\Windows\System\RFcOvWS.exe
  C:\Windows\System\RFcOvWS.exe
  2⤵
  PID:6616
- C:\Windows\System\qTlohpc.exe
  C:\Windows\System\qTlohpc.exe
  2⤵
  PID:6760
- C:\Windows\System\wNyesGR.exe
  C:\Windows\System\wNyesGR.exe
  2⤵
  PID:6824
- C:\Windows\System\QuDPbtf.exe
  C:\Windows\System\QuDPbtf.exe
  2⤵
  PID:6924
- C:\Windows\System\iCkvKKQ.exe
  C:\Windows\System\iCkvKKQ.exe
  2⤵
  PID:7100
- C:\Windows\System\amQOlIZ.exe
  C:\Windows\System\amQOlIZ.exe
  2⤵
  PID:5776
- C:\Windows\System\Aarmnal.exe
  C:\Windows\System\Aarmnal.exe
  2⤵
  PID:6172
- C:\Windows\System\BhrfUPy.exe
  C:\Windows\System\BhrfUPy.exe
  2⤵
  PID:5264
- C:\Windows\System\gVLfRcK.exe
  C:\Windows\System\gVLfRcK.exe
  2⤵
  PID:6788
- C:\Windows\System\kbiWnuc.exe
  C:\Windows\System\kbiWnuc.exe
  2⤵
  PID:6956
- C:\Windows\System\Espilol.exe
  C:\Windows\System\Espilol.exe
  2⤵
  PID:7024
- C:\Windows\System\VuuGYub.exe
  C:\Windows\System\VuuGYub.exe
  2⤵
  PID:5148
- C:\Windows\System\alcGqNw.exe
  C:\Windows\System\alcGqNw.exe
  2⤵
  PID:5640
- C:\Windows\System\RoLeGrd.exe
  C:\Windows\System\RoLeGrd.exe
  2⤵
  PID:5296
- C:\Windows\System\poYMyof.exe
  C:\Windows\System\poYMyof.exe
  2⤵
  PID:6020
- C:\Windows\System\UovSCBM.exe
  C:\Windows\System\UovSCBM.exe
  2⤵
  PID:5228
- C:\Windows\System\ZKZvrjz.exe
  C:\Windows\System\ZKZvrjz.exe
  2⤵
  PID:6420
- C:\Windows\System\PCwcVQL.exe
  C:\Windows\System\PCwcVQL.exe
  2⤵
  PID:6368
- C:\Windows\System\rZcKqcy.exe
  C:\Windows\System\rZcKqcy.exe
  2⤵
  PID:6664
- C:\Windows\System\nugUnCs.exe
  C:\Windows\System\nugUnCs.exe
  2⤵
  PID:6452
- C:\Windows\System\wrPRaBg.exe
  C:\Windows\System\wrPRaBg.exe
  2⤵
  PID:6536
- C:\Windows\System\JRJyQnM.exe
  C:\Windows\System\JRJyQnM.exe
  2⤵
  PID:6828
- C:\Windows\System\yMtOdGs.exe
  C:\Windows\System\yMtOdGs.exe
  2⤵
  PID:5268
- C:\Windows\System\tRWMLtH.exe
  C:\Windows\System\tRWMLtH.exe
  2⤵
  PID:5896
- C:\Windows\System\weJefFk.exe
  C:\Windows\System\weJefFk.exe
  2⤵
  PID:7004
- C:\Windows\System\LLRNBRy.exe
  C:\Windows\System\LLRNBRy.exe
  2⤵
  PID:6356
- C:\Windows\System\UwEIjMh.exe
  C:\Windows\System\UwEIjMh.exe
  2⤵
  PID:6756
- C:\Windows\System\ZnyDBrW.exe
  C:\Windows\System\ZnyDBrW.exe
  2⤵
  PID:6520
- C:\Windows\System\LasxYgJ.exe
  C:\Windows\System\LasxYgJ.exe
  2⤵
  PID:6724
- C:\Windows\System\zXiJxOV.exe
  C:\Windows\System\zXiJxOV.exe
  2⤵
  PID:4160
- C:\Windows\System\aYZsRaC.exe
  C:\Windows\System\aYZsRaC.exe
  2⤵
  PID:6804
- C:\Windows\System\NshLlGd.exe
  C:\Windows\System\NshLlGd.exe
  2⤵
  PID:5760
- C:\Windows\System\NqbWxAu.exe
  C:\Windows\System\NqbWxAu.exe
  2⤵
  PID:6936
- C:\Windows\System\tnXohJP.exe
  C:\Windows\System\tnXohJP.exe
  2⤵
  PID:5824
- C:\Windows\System\VZZbkAG.exe
  C:\Windows\System\VZZbkAG.exe
  2⤵
  PID:7172
- C:\Windows\System\bQHYmIr.exe
  C:\Windows\System\bQHYmIr.exe
  2⤵
  PID:7188
- C:\Windows\System\kPCvsjc.exe
  C:\Windows\System\kPCvsjc.exe
  2⤵
  PID:7204
- C:\Windows\System\WFhFDUy.exe
  C:\Windows\System\WFhFDUy.exe
  2⤵
  PID:7220
- C:\Windows\System\ABTnZEq.exe
  C:\Windows\System\ABTnZEq.exe
  2⤵
  PID:7240
- C:\Windows\System\hdSxmqG.exe
  C:\Windows\System\hdSxmqG.exe
  2⤵
  PID:7256
- C:\Windows\System\FVXcQcv.exe
  C:\Windows\System\FVXcQcv.exe
  2⤵
  PID:7272
- C:\Windows\System\BPYRJNt.exe
  C:\Windows\System\BPYRJNt.exe
  2⤵
  PID:7288
- C:\Windows\System\fSwStck.exe
  C:\Windows\System\fSwStck.exe
  2⤵
  PID:7304
- C:\Windows\System\SpNLUFA.exe
  C:\Windows\System\SpNLUFA.exe
  2⤵
  PID:7320
- C:\Windows\System\HalqcHQ.exe
  C:\Windows\System\HalqcHQ.exe
  2⤵
  PID:7336
- C:\Windows\System\mRLOXbW.exe
  C:\Windows\System\mRLOXbW.exe
  2⤵
  PID:7352
- C:\Windows\System\wCgkrHJ.exe
  C:\Windows\System\wCgkrHJ.exe
  2⤵
  PID:7368
- C:\Windows\System\TIltdIK.exe
  C:\Windows\System\TIltdIK.exe
  2⤵
  PID:7384
- C:\Windows\System\DXLqNtm.exe
  C:\Windows\System\DXLqNtm.exe
  2⤵
  PID:7400
- C:\Windows\System\JAHvtDb.exe
  C:\Windows\System\JAHvtDb.exe
  2⤵
  PID:7416
- C:\Windows\System\xIkFnpz.exe
  C:\Windows\System\xIkFnpz.exe
  2⤵
  PID:7432
- C:\Windows\System\RKcidUc.exe
  C:\Windows\System\RKcidUc.exe
  2⤵
  PID:7448
- C:\Windows\System\XrAqThy.exe
  C:\Windows\System\XrAqThy.exe
  2⤵
  PID:7464
- C:\Windows\System\KKHeISh.exe
  C:\Windows\System\KKHeISh.exe
  2⤵
  PID:7536
- C:\Windows\System\xBDLbiJ.exe
  C:\Windows\System\xBDLbiJ.exe
  2⤵
  PID:7552
- C:\Windows\System\MZoCkSU.exe
  C:\Windows\System\MZoCkSU.exe
  2⤵
  PID:7568
- C:\Windows\System\rswIhLa.exe
  C:\Windows\System\rswIhLa.exe
  2⤵
  PID:7588
- C:\Windows\System\fjIZTFU.exe
  C:\Windows\System\fjIZTFU.exe
  2⤵
  PID:7604
- C:\Windows\System\PpFKAYf.exe
  C:\Windows\System\PpFKAYf.exe
  2⤵
  PID:7620
- C:\Windows\System\muQxTuh.exe
  C:\Windows\System\muQxTuh.exe
  2⤵
  PID:7636
- C:\Windows\System\nxuJrxi.exe
  C:\Windows\System\nxuJrxi.exe
  2⤵
  PID:7652
- C:\Windows\System\NGorFEb.exe
  C:\Windows\System\NGorFEb.exe
  2⤵
  PID:7668
- C:\Windows\System\gGPjMvh.exe
  C:\Windows\System\gGPjMvh.exe
  2⤵
  PID:7684
- C:\Windows\System\TfqFoNW.exe
  C:\Windows\System\TfqFoNW.exe
  2⤵
  PID:7700
- C:\Windows\System\IbLcReq.exe
  C:\Windows\System\IbLcReq.exe
  2⤵
  PID:7720
- C:\Windows\System\RmXeQhK.exe
  C:\Windows\System\RmXeQhK.exe
  2⤵
  PID:7736
- C:\Windows\System\NrHlAtH.exe
  C:\Windows\System\NrHlAtH.exe
  2⤵
  PID:7752
- C:\Windows\System\MkQrAiz.exe
  C:\Windows\System\MkQrAiz.exe
  2⤵
  PID:7768
- C:\Windows\System\hpCMzhw.exe
  C:\Windows\System\hpCMzhw.exe
  2⤵
  PID:7784
- C:\Windows\System\zrenzKm.exe
  C:\Windows\System\zrenzKm.exe
  2⤵
  PID:7804
- C:\Windows\System\XdEdmxN.exe
  C:\Windows\System\XdEdmxN.exe
  2⤵
  PID:7824
- C:\Windows\System\PyfIYUC.exe
  C:\Windows\System\PyfIYUC.exe
  2⤵
  PID:7840
- C:\Windows\System\KTTTUcy.exe
  C:\Windows\System\KTTTUcy.exe
  2⤵
  PID:7856
- C:\Windows\System\mSPVqgF.exe
  C:\Windows\System\mSPVqgF.exe
  2⤵
  PID:7872
- C:\Windows\System\iTarLIt.exe
  C:\Windows\System\iTarLIt.exe
  2⤵
  PID:7888
- C:\Windows\System\DQijBgt.exe
  C:\Windows\System\DQijBgt.exe
  2⤵
  PID:7904
- C:\Windows\System\dWnoltw.exe
  C:\Windows\System\dWnoltw.exe
  2⤵
  PID:7924
- C:\Windows\System\FhfBNaw.exe
  C:\Windows\System\FhfBNaw.exe
  2⤵
  PID:8028
- C:\Windows\System\nSBSopi.exe
  C:\Windows\System\nSBSopi.exe
  2⤵
  PID:8044
- C:\Windows\System\BTzqqMz.exe
  C:\Windows\System\BTzqqMz.exe
  2⤵
  PID:8060
- C:\Windows\System\nDTjjKd.exe
  C:\Windows\System\nDTjjKd.exe
  2⤵
  PID:8076
- C:\Windows\System\aruHPwp.exe
  C:\Windows\System\aruHPwp.exe
  2⤵
  PID:8092
- C:\Windows\System\jqQLDfa.exe
  C:\Windows\System\jqQLDfa.exe
  2⤵
  PID:8108
- C:\Windows\System\VHnjADx.exe
  C:\Windows\System\VHnjADx.exe
  2⤵
  PID:8124
- C:\Windows\System\IqDRLMg.exe
  C:\Windows\System\IqDRLMg.exe
  2⤵
  PID:8140
- C:\Windows\System\YNekgYX.exe
  C:\Windows\System\YNekgYX.exe
  2⤵
  PID:8156
- C:\Windows\System\VdjXeXb.exe
  C:\Windows\System\VdjXeXb.exe
  2⤵
  PID:8172
- C:\Windows\System\PxSYUik.exe
  C:\Windows\System\PxSYUik.exe
  2⤵
  PID:8188
- C:\Windows\System\fiXjmPt.exe
  C:\Windows\System\fiXjmPt.exe
  2⤵
  PID:7216
- C:\Windows\System\JIGwzJa.exe
  C:\Windows\System\JIGwzJa.exe
  2⤵
  PID:7280
- C:\Windows\System\erUgwco.exe
  C:\Windows\System\erUgwco.exe
  2⤵
  PID:7344
- C:\Windows\System\mSFoXmt.exe
  C:\Windows\System\mSFoXmt.exe
  2⤵
  PID:7380
- C:\Windows\System\bNkhfXN.exe
  C:\Windows\System\bNkhfXN.exe
  2⤵
  PID:7412
- C:\Windows\System\pOIJVPc.exe
  C:\Windows\System\pOIJVPc.exe
  2⤵
  PID:6320
- C:\Windows\System\RtLhMsp.exe
  C:\Windows\System\RtLhMsp.exe
  2⤵
  PID:6628
- C:\Windows\System\OvBDvpD.exe
  C:\Windows\System\OvBDvpD.exe
  2⤵
  PID:7232
- C:\Windows\System\kXeWIdc.exe
  C:\Windows\System\kXeWIdc.exe
  2⤵
  PID:7300
- C:\Windows\System\awETEVq.exe
  C:\Windows\System\awETEVq.exe
  2⤵
  PID:7364
- C:\Windows\System\HPLUVJB.exe
  C:\Windows\System\HPLUVJB.exe
  2⤵
  PID:7440
- C:\Windows\System\Yeegmry.exe
  C:\Windows\System\Yeegmry.exe
  2⤵
  PID:7460
- C:\Windows\System\QIVYrze.exe
  C:\Windows\System\QIVYrze.exe
  2⤵
  PID:7484
- C:\Windows\System\zNHMWPx.exe
  C:\Windows\System\zNHMWPx.exe
  2⤵
  PID:7496
- C:\Windows\System\aOgsEjr.exe
  C:\Windows\System\aOgsEjr.exe
  2⤵
  PID:7516
- C:\Windows\System\gCWNjUq.exe
  C:\Windows\System\gCWNjUq.exe
  2⤵
  PID:7528
- C:\Windows\System\ZgeYtXn.exe
  C:\Windows\System\ZgeYtXn.exe
  2⤵
  PID:7564
- C:\Windows\System\IEeSDxo.exe
  C:\Windows\System\IEeSDxo.exe
  2⤵
  PID:7548
- C:\Windows\System\wLrfPPk.exe
  C:\Windows\System\wLrfPPk.exe
  2⤵
  PID:7628
- C:\Windows\System\PzJFZPi.exe
  C:\Windows\System\PzJFZPi.exe
  2⤵
  PID:7660
- C:\Windows\System\BhABXXM.exe
  C:\Windows\System\BhABXXM.exe
  2⤵
  PID:7680
- C:\Windows\System\skqxVhc.exe
  C:\Windows\System\skqxVhc.exe
  2⤵
  PID:7708
- C:\Windows\System\KQOZwDf.exe
  C:\Windows\System\KQOZwDf.exe
  2⤵
  PID:7760
- C:\Windows\System\KcAacul.exe
  C:\Windows\System\KcAacul.exe
  2⤵
  PID:7776
- C:\Windows\System\BwShtFx.exe
  C:\Windows\System\BwShtFx.exe
  2⤵
  PID:7832
- C:\Windows\System\DnpcvqJ.exe
  C:\Windows\System\DnpcvqJ.exe
  2⤵
  PID:7896
- C:\Windows\System\BdRNqtY.exe
  C:\Windows\System\BdRNqtY.exe
  2⤵
  PID:7884
- C:\Windows\System\PARpJbT.exe
  C:\Windows\System\PARpJbT.exe
  2⤵
  PID:7816
- C:\Windows\System\QbVlahx.exe
  C:\Windows\System\QbVlahx.exe
  2⤵
  PID:7852
- C:\Windows\System\FyoLlNZ.exe
  C:\Windows\System\FyoLlNZ.exe
  2⤵
  PID:7944
- C:\Windows\System\nNlNxAS.exe
  C:\Windows\System\nNlNxAS.exe
  2⤵
  PID:7960
- C:\Windows\System\thoErDb.exe
  C:\Windows\System\thoErDb.exe
  2⤵
  PID:7976
- C:\Windows\System\ZFYZGEj.exe
  C:\Windows\System\ZFYZGEj.exe
  2⤵
  PID:7992
- C:\Windows\System\CdaHfXK.exe
  C:\Windows\System\CdaHfXK.exe
  2⤵
  PID:8012
- C:\Windows\System\nddmQHe.exe
  C:\Windows\System\nddmQHe.exe
  2⤵
  PID:8024
- C:\Windows\System\uQmXxYc.exe
  C:\Windows\System\uQmXxYc.exe
  2⤵
  PID:8084
- C:\Windows\System\qDKBxEO.exe
  C:\Windows\System\qDKBxEO.exe
  2⤵
  PID:8120
- C:\Windows\System\mDoTlcG.exe
  C:\Windows\System\mDoTlcG.exe
  2⤵
  PID:8072
- C:\Windows\System\ZMWfZGn.exe
  C:\Windows\System\ZMWfZGn.exe
  2⤵
  PID:8180
- C:\Windows\System\DzKceHD.exe
  C:\Windows\System\DzKceHD.exe
  2⤵
  PID:7376
- C:\Windows\System\nsjXJwd.exe
  C:\Windows\System\nsjXJwd.exe
  2⤵
  PID:7196
- C:\Windows\System\dFDKPdN.exe
  C:\Windows\System\dFDKPdN.exe
  2⤵
  PID:8168
- C:\Windows\System\nddQGOY.exe
  C:\Windows\System\nddQGOY.exe
  2⤵
  PID:7268
- C:\Windows\System\uPNvybg.exe
  C:\Windows\System\uPNvybg.exe
  2⤵
  PID:5300
- C:\Windows\System\RCbzEDt.exe
  C:\Windows\System\RCbzEDt.exe
  2⤵
  PID:7424
- C:\Windows\System\TrpMkdL.exe
  C:\Windows\System\TrpMkdL.exe
  2⤵
  PID:7476
- C:\Windows\System\INYfMnb.exe
  C:\Windows\System\INYfMnb.exe
  2⤵
  PID:7164
- C:\Windows\System\KTMGCPE.exe
  C:\Windows\System\KTMGCPE.exe
  2⤵
  PID:7600
- C:\Windows\System\bMMDMqa.exe
  C:\Windows\System\bMMDMqa.exe
  2⤵
  PID:7648
- C:\Windows\System\fcTaqFn.exe
  C:\Windows\System\fcTaqFn.exe
  2⤵
  PID:7864
- C:\Windows\System\tpfQoid.exe
  C:\Windows\System\tpfQoid.exe
  2⤵
  PID:7940
- C:\Windows\System\EgqaStM.exe
  C:\Windows\System\EgqaStM.exe
  2⤵
  PID:7972
- C:\Windows\System\TcpMVAp.exe
  C:\Windows\System\TcpMVAp.exe
  2⤵
  PID:8000
- C:\Windows\System\pyQovHu.exe
  C:\Windows\System\pyQovHu.exe
  2⤵
  PID:8116
- C:\Windows\System\fFUirXT.exe
  C:\Windows\System\fFUirXT.exe
  2⤵
  PID:8104
- C:\Windows\System\OElDzgF.exe
  C:\Windows\System\OElDzgF.exe
  2⤵
  PID:8148
- C:\Windows\System\tDfYpbe.exe
  C:\Windows\System\tDfYpbe.exe
  2⤵
  PID:7052
- C:\Windows\System\ThQRZyU.exe
  C:\Windows\System\ThQRZyU.exe
  2⤵
  PID:7396
- C:\Windows\System\XzGVefR.exe
  C:\Windows\System\XzGVefR.exe
  2⤵
  PID:7444
- C:\Windows\System\EaCpaDe.exe
  C:\Windows\System\EaCpaDe.exe
  2⤵
  PID:7520
- C:\Windows\System\SbxDpOt.exe
  C:\Windows\System\SbxDpOt.exe
  2⤵
  PID:7644
- C:\Windows\System\YUFHrjd.exe
  C:\Windows\System\YUFHrjd.exe
  2⤵
  PID:7580
- C:\Windows\System\yQcuYww.exe
  C:\Windows\System\yQcuYww.exe
  2⤵
  PID:7748
- C:\Windows\System\whGfcpU.exe
  C:\Windows\System\whGfcpU.exe
  2⤵
  PID:8204
- C:\Windows\System\LBOYjTl.exe
  C:\Windows\System\LBOYjTl.exe
  2⤵
  PID:8308
- C:\Windows\System\ZXuGZdH.exe
  C:\Windows\System\ZXuGZdH.exe
  2⤵
  PID:8376
- C:\Windows\System\Vlyonej.exe
  C:\Windows\System\Vlyonej.exe
  2⤵
  PID:8396
- C:\Windows\System\RTvLZYe.exe
  C:\Windows\System\RTvLZYe.exe
  2⤵
  PID:8412
- C:\Windows\System\ZmffmyR.exe
  C:\Windows\System\ZmffmyR.exe
  2⤵
  PID:8428
- C:\Windows\System\fNnNvGv.exe
  C:\Windows\System\fNnNvGv.exe
  2⤵
  PID:8444
- C:\Windows\System\bzMQzRR.exe
  C:\Windows\System\bzMQzRR.exe
  2⤵
  PID:8460
- C:\Windows\System\URDGPmP.exe
  C:\Windows\System\URDGPmP.exe
  2⤵
  PID:8476
- C:\Windows\System\ntvXxnt.exe
  C:\Windows\System\ntvXxnt.exe
  2⤵
  PID:8492
- C:\Windows\System\CmssTZq.exe
  C:\Windows\System\CmssTZq.exe
  2⤵
  PID:8508
- C:\Windows\System\IRWqEKs.exe
  C:\Windows\System\IRWqEKs.exe
  2⤵
  PID:8524
- C:\Windows\System\jrgXhWm.exe
  C:\Windows\System\jrgXhWm.exe
  2⤵
  PID:8540
- C:\Windows\System\JiczPwB.exe
  C:\Windows\System\JiczPwB.exe
  2⤵
  PID:8556
- C:\Windows\System\XNDbUsf.exe
  C:\Windows\System\XNDbUsf.exe
  2⤵
  PID:8584
- C:\Windows\System\NNcnzNV.exe
  C:\Windows\System\NNcnzNV.exe
  2⤵
  PID:8600
- C:\Windows\System\jusVSse.exe
  C:\Windows\System\jusVSse.exe
  2⤵
  PID:8616
- C:\Windows\System\pPtQAcS.exe
  C:\Windows\System\pPtQAcS.exe
  2⤵
  PID:8632
- C:\Windows\System\xywndNh.exe
  C:\Windows\System\xywndNh.exe
  2⤵
  PID:8828
- C:\Windows\System\BHvUWII.exe
  C:\Windows\System\BHvUWII.exe
  2⤵
  PID:8844
- C:\Windows\System\LlkKbMS.exe
  C:\Windows\System\LlkKbMS.exe
  2⤵
  PID:8860
- C:\Windows\System\eKlmPGq.exe
  C:\Windows\System\eKlmPGq.exe
  2⤵
  PID:8876
- C:\Windows\System\qHZdSUN.exe
  C:\Windows\System\qHZdSUN.exe
  2⤵
  PID:8892
- C:\Windows\System\nwHFJCm.exe
  C:\Windows\System\nwHFJCm.exe
  2⤵
  PID:8908
- C:\Windows\System\pEQDIZu.exe
  C:\Windows\System\pEQDIZu.exe
  2⤵
  PID:8924
- C:\Windows\System\TsawQPg.exe
  C:\Windows\System\TsawQPg.exe
  2⤵
  PID:8940
- C:\Windows\System\DgmvmxA.exe
  C:\Windows\System\DgmvmxA.exe
  2⤵
  PID:8956
- C:\Windows\System\CePlKiZ.exe
  C:\Windows\System\CePlKiZ.exe
  2⤵
  PID:8980
- C:\Windows\System\EsdeUJT.exe
  C:\Windows\System\EsdeUJT.exe
  2⤵
  PID:8996
- C:\Windows\System\Dtyfeqh.exe
  C:\Windows\System\Dtyfeqh.exe
  2⤵
  PID:9012
- C:\Windows\System\tcDxMYd.exe
  C:\Windows\System\tcDxMYd.exe
  2⤵
  PID:9032
- C:\Windows\System\reFOLFH.exe
  C:\Windows\System\reFOLFH.exe
  2⤵
  PID:9124
- C:\Windows\System\nFJecKp.exe
  C:\Windows\System\nFJecKp.exe
  2⤵
  PID:9140
- C:\Windows\System\yyuPSHv.exe
  C:\Windows\System\yyuPSHv.exe
  2⤵
  PID:9156
- C:\Windows\System\aYQobYl.exe
  C:\Windows\System\aYQobYl.exe
  2⤵
  PID:9172
- C:\Windows\System\MBtrens.exe
  C:\Windows\System\MBtrens.exe
  2⤵
  PID:9188
- C:\Windows\System\ILsfQqB.exe
  C:\Windows\System\ILsfQqB.exe
  2⤵
  PID:9204
- C:\Windows\System\HaYVMyj.exe
  C:\Windows\System\HaYVMyj.exe
  2⤵
  PID:7848
- C:\Windows\System\SfyUyac.exe
  C:\Windows\System\SfyUyac.exe
  2⤵
  PID:8132
- C:\Windows\System\XrhhaNd.exe
  C:\Windows\System\XrhhaNd.exe
  2⤵
  PID:7632
- C:\Windows\System\SrOQNHg.exe
  C:\Windows\System\SrOQNHg.exe
  2⤵
  PID:8240
- C:\Windows\System\mlkOwPQ.exe
  C:\Windows\System\mlkOwPQ.exe
  2⤵
  PID:8264
- C:\Windows\System\UyHFnJi.exe
  C:\Windows\System\UyHFnJi.exe
  2⤵
  PID:8300
- C:\Windows\System\MblwONt.exe
  C:\Windows\System\MblwONt.exe
  2⤵
  PID:8284
- C:\Windows\System\GBFhQjL.exe
  C:\Windows\System\GBFhQjL.exe
  2⤵
  PID:8260
- C:\Windows\System\kpTKuhH.exe
  C:\Windows\System\kpTKuhH.exe
  2⤵
  PID:8596
- C:\Windows\System\HfBhXzG.exe
  C:\Windows\System\HfBhXzG.exe
  2⤵
  PID:8520
- C:\Windows\System\fbDgrBu.exe
  C:\Windows\System\fbDgrBu.exe
  2⤵
  PID:8452
- C:\Windows\System\tomsjQW.exe
  C:\Windows\System\tomsjQW.exe
  2⤵
  PID:8388
- C:\Windows\System\ltiYqpU.exe
  C:\Windows\System\ltiYqpU.exe
  2⤵
  PID:8016
- C:\Windows\System\VOiyiPX.exe
  C:\Windows\System\VOiyiPX.exe
  2⤵
  PID:7316
- C:\Windows\System\MnOaiNg.exe
  C:\Windows\System\MnOaiNg.exe
  2⤵
  PID:7560
- C:\Windows\System\fGgwMOs.exe
  C:\Windows\System\fGgwMOs.exe
  2⤵
  PID:8316
- C:\Windows\System\qIPbxkf.exe
  C:\Windows\System\qIPbxkf.exe
  2⤵
  PID:8348
- C:\Windows\System\aPxkfNe.exe
  C:\Windows\System\aPxkfNe.exe
  2⤵
  PID:8368
- C:\Windows\System\VpCZTgE.exe
  C:\Windows\System\VpCZTgE.exe
  2⤵
  PID:8436
- C:\Windows\System\vuXAfma.exe
  C:\Windows\System\vuXAfma.exe
  2⤵
  PID:8500
- C:\Windows\System\nXHShOS.exe
  C:\Windows\System\nXHShOS.exe
  2⤵
  PID:8564
- C:\Windows\System\XVApEZQ.exe
  C:\Windows\System\XVApEZQ.exe
  2⤵
  PID:8580
- C:\Windows\System\wUATURf.exe
  C:\Windows\System\wUATURf.exe
  2⤵
  PID:8856
- C:\Windows\System\uvUSwoB.exe
  C:\Windows\System\uvUSwoB.exe
  2⤵
  PID:8920
- C:\Windows\System\apTACgw.exe
  C:\Windows\System\apTACgw.exe
  2⤵
  PID:8992
- C:\Windows\System\zXsnfEO.exe
  C:\Windows\System\zXsnfEO.exe
  2⤵
  PID:8640
- C:\Windows\System\qkMJGJK.exe
  C:\Windows\System\qkMJGJK.exe
  2⤵
  PID:9028
- C:\Windows\System\PEksKZA.exe
  C:\Windows\System\PEksKZA.exe
  2⤵
  PID:9164
- C:\Windows\System\rIGKuhs.exe
  C:\Windows\System\rIGKuhs.exe
  2⤵
  PID:7716
- C:\Windows\System\WTBWfcw.exe
  C:\Windows\System\WTBWfcw.exe
  2⤵
  PID:8752
- C:\Windows\System\QTmagmh.exe
  C:\Windows\System\QTmagmh.exe
  2⤵
  PID:9232
- C:\Windows\System\qhJwAyX.exe
  C:\Windows\System\qhJwAyX.exe
  2⤵
  PID:9256
- C:\Windows\System\RIlbMsf.exe
  C:\Windows\System\RIlbMsf.exe
  2⤵
  PID:9280
- C:\Windows\System\uHXKEnE.exe
  C:\Windows\System\uHXKEnE.exe
  2⤵
  PID:9360
- C:\Windows\System\iXdKmGr.exe
  C:\Windows\System\iXdKmGr.exe
  2⤵
  PID:9380
- C:\Windows\System\leKHStH.exe
  C:\Windows\System\leKHStH.exe
  2⤵
  PID:9396
- C:\Windows\System\mGRldft.exe
  C:\Windows\System\mGRldft.exe
  2⤵
  PID:9412
- C:\Windows\System\UCnYStD.exe
  C:\Windows\System\UCnYStD.exe
  2⤵
  PID:9428
- C:\Windows\System\OjScFyq.exe
  C:\Windows\System\OjScFyq.exe
  2⤵
  PID:9444
- C:\Windows\System\MZGEdcr.exe
  C:\Windows\System\MZGEdcr.exe
  2⤵
  PID:9460
- C:\Windows\System\hNFgeAu.exe
  C:\Windows\System\hNFgeAu.exe
  2⤵
  PID:9476
- C:\Windows\System\AhDHACQ.exe
  C:\Windows\System\AhDHACQ.exe
  2⤵
  PID:9492
- C:\Windows\System\rWbJuvI.exe
  C:\Windows\System\rWbJuvI.exe
  2⤵
  PID:9508
- C:\Windows\System\ajPVDqm.exe
  C:\Windows\System\ajPVDqm.exe
  2⤵
  PID:9524
- C:\Windows\System\JOKVKSk.exe
  C:\Windows\System\JOKVKSk.exe
  2⤵
  PID:9556
- C:\Windows\System\thhGrAz.exe
  C:\Windows\System\thhGrAz.exe
  2⤵
  PID:9572
- C:\Windows\System\KaAHspq.exe
  C:\Windows\System\KaAHspq.exe
  2⤵
  PID:9588
- C:\Windows\System\ECGtIVf.exe
  C:\Windows\System\ECGtIVf.exe
  2⤵
  PID:9608
- C:\Windows\System\ApuXixR.exe
  C:\Windows\System\ApuXixR.exe
  2⤵
  PID:9624
- C:\Windows\System\lyJhJBJ.exe
  C:\Windows\System\lyJhJBJ.exe
  2⤵
  PID:9644
- C:\Windows\System\adLjXNN.exe
  C:\Windows\System\adLjXNN.exe
  2⤵
  PID:9672
- C:\Windows\System\tjeUzWf.exe
  C:\Windows\System\tjeUzWf.exe
  2⤵
  PID:9688
- C:\Windows\System\dsWUpLZ.exe
  C:\Windows\System\dsWUpLZ.exe
  2⤵
  PID:9712
- C:\Windows\System\yvyQkfB.exe
  C:\Windows\System\yvyQkfB.exe
  2⤵
  PID:9732
- C:\Windows\System\GWeRodl.exe
  C:\Windows\System\GWeRodl.exe
  2⤵
  PID:9760
- C:\Windows\System\yGxqgPY.exe
  C:\Windows\System\yGxqgPY.exe
  2⤵
  PID:9780
- C:\Windows\System\gYRDdqy.exe
  C:\Windows\System\gYRDdqy.exe
  2⤵
  PID:9800
- C:\Windows\System\kTfHCCc.exe
  C:\Windows\System\kTfHCCc.exe
  2⤵
  PID:9824
- C:\Windows\System\mhhWVty.exe
  C:\Windows\System\mhhWVty.exe
  2⤵
  PID:9844
- C:\Windows\System\CInJGry.exe
  C:\Windows\System\CInJGry.exe
  2⤵
  PID:9864
- C:\Windows\System\AvhBQwZ.exe
  C:\Windows\System\AvhBQwZ.exe
  2⤵
  PID:9880
- C:\Windows\System\ZBAMIZB.exe
  C:\Windows\System\ZBAMIZB.exe
  2⤵
  PID:9896
- C:\Windows\System\RVTYaOR.exe
  C:\Windows\System\RVTYaOR.exe
  2⤵
  PID:9916
- C:\Windows\System\EkxuKQY.exe
  C:\Windows\System\EkxuKQY.exe
  2⤵
  PID:9932
- C:\Windows\System\PDNXrMp.exe
  C:\Windows\System\PDNXrMp.exe
  2⤵
  PID:9948
- C:\Windows\System\uYhxlRh.exe
  C:\Windows\System\uYhxlRh.exe
  2⤵
  PID:9964
- C:\Windows\System\IsrOLcu.exe
  C:\Windows\System\IsrOLcu.exe
  2⤵
  PID:9980
- C:\Windows\System\dmIZGoP.exe
  C:\Windows\System\dmIZGoP.exe
  2⤵
  PID:9996
- C:\Windows\System\hWmWskR.exe
  C:\Windows\System\hWmWskR.exe
  2⤵
  PID:10012
- C:\Windows\System\ZtVeCos.exe
  C:\Windows\System\ZtVeCos.exe
  2⤵
  PID:10032
- C:\Windows\System\ugFtYFU.exe
  C:\Windows\System\ugFtYFU.exe
  2⤵
  PID:10048
- C:\Windows\System\MnYZNfO.exe
  C:\Windows\System\MnYZNfO.exe
  2⤵
  PID:10064
- C:\Windows\System\wKSzDHW.exe
  C:\Windows\System\wKSzDHW.exe
  2⤵
  PID:10080
- C:\Windows\System\QvKUwSd.exe
  C:\Windows\System\QvKUwSd.exe
  2⤵
  PID:10096
- C:\Windows\System\MuunCOK.exe
  C:\Windows\System\MuunCOK.exe
  2⤵
  PID:10112
- C:\Windows\System\gYmblCa.exe
  C:\Windows\System\gYmblCa.exe
  2⤵
  PID:10128
- C:\Windows\System\TWhVDqC.exe
  C:\Windows\System\TWhVDqC.exe
  2⤵
  PID:10144
- C:\Windows\System\BDQEWcX.exe
  C:\Windows\System\BDQEWcX.exe
  2⤵
  PID:10160
- C:\Windows\System\rNaxTCS.exe
  C:\Windows\System\rNaxTCS.exe
  2⤵
  PID:10176
- C:\Windows\System\nJOVVnu.exe
  C:\Windows\System\nJOVVnu.exe
  2⤵
  PID:10192
- C:\Windows\System\QpbdAHP.exe
  C:\Windows\System\QpbdAHP.exe
  2⤵
  PID:10208
- C:\Windows\System\erYgoRe.exe
  C:\Windows\System\erYgoRe.exe
  2⤵
  PID:10224
- C:\Windows\System\pYUTGNy.exe
  C:\Windows\System\pYUTGNy.exe
  2⤵
  PID:9024
- C:\Windows\System\drfuROe.exe
  C:\Windows\System\drfuROe.exe
  2⤵
  PID:8672
- C:\Windows\System\lfcgDep.exe
  C:\Windows\System\lfcgDep.exe
  2⤵
  PID:8692
- C:\Windows\System\cSHQWfx.exe
  C:\Windows\System\cSHQWfx.exe
  2⤵
  PID:8708
- C:\Windows\System\pMoawpt.exe
  C:\Windows\System\pMoawpt.exe
  2⤵
  PID:8732
- C:\Windows\System\BJUxxgl.exe
  C:\Windows\System\BJUxxgl.exe
  2⤵
  PID:8760
- C:\Windows\System\wRYwYKb.exe
  C:\Windows\System\wRYwYKb.exe
  2⤵
  PID:8780
- C:\Windows\System\zFkjNOP.exe
  C:\Windows\System\zFkjNOP.exe
  2⤵
  PID:8796
- C:\Windows\System\DGHSoym.exe
  C:\Windows\System\DGHSoym.exe
  2⤵
  PID:8812
- C:\Windows\System\pjCNWau.exe
  C:\Windows\System\pjCNWau.exe
  2⤵
  PID:8824
- C:\Windows\System\vqgcLUi.exe
  C:\Windows\System\vqgcLUi.exe
  2⤵
  PID:8248
- C:\Windows\System\qlbFFbf.exe
  C:\Windows\System\qlbFFbf.exe
  2⤵
  PID:8392
- C:\Windows\System\rIGDXXi.exe
  C:\Windows\System\rIGDXXi.exe
  2⤵
  PID:8200
- C:\Windows\System\CoBJqMa.exe
  C:\Windows\System\CoBJqMa.exe
  2⤵
  PID:8576
- C:\Windows\System\DkeiHuW.exe
  C:\Windows\System\DkeiHuW.exe
  2⤵
  PID:9668
- C:\Windows\System\ApccmNB.exe
  C:\Windows\System\ApccmNB.exe
  2⤵
  PID:9816
- C:\Windows\System\EhgmJbZ.exe
  C:\Windows\System\EhgmJbZ.exe
  2⤵
  PID:9856
- C:\Windows\System\KzrsmhT.exe
  C:\Windows\System\KzrsmhT.exe
  2⤵
  PID:9956
- C:\Windows\System\tmjfmpA.exe
  C:\Windows\System\tmjfmpA.exe
  2⤵
  PID:10024
- C:\Windows\System\sABPmQx.exe
  C:\Windows\System\sABPmQx.exe
  2⤵
  PID:10092
- C:\Windows\System\ggDroLH.exe
  C:\Windows\System\ggDroLH.exe
  2⤵
  PID:10184
- C:\Windows\System\kEWslCJ.exe
  C:\Windows\System\kEWslCJ.exe
  2⤵
  PID:8660
- C:\Windows\System\qfiVubw.exe
  C:\Windows\System\qfiVubw.exe
  2⤵
  PID:8744
- C:\Windows\System\dAJrmmJ.exe
  C:\Windows\System\dAJrmmJ.exe
  2⤵
  PID:8364
- C:\Windows\System\IEBmJQZ.exe
  C:\Windows\System\IEBmJQZ.exe
  2⤵
  PID:9008
- C:\Windows\System\xePvrlQ.exe
  C:\Windows\System\xePvrlQ.exe
  2⤵
  PID:8652
- C:\Windows\System\BkjHByN.exe
  C:\Windows\System\BkjHByN.exe
  2⤵
  PID:9544
- C:\Windows\System\mXFgdqW.exe
  C:\Windows\System\mXFgdqW.exe
  2⤵
  PID:10204
- C:\Windows\System\jqHqrRo.exe
  C:\Windows\System\jqHqrRo.exe
  2⤵
  PID:8968
- C:\Windows\System\Uszbeph.exe
  C:\Windows\System\Uszbeph.exe
  2⤵
  PID:8328
- C:\Windows\System\tpqdKQt.exe
  C:\Windows\System\tpqdKQt.exe
  2⤵
  PID:8900
- C:\Windows\System\rATCmAx.exe
  C:\Windows\System\rATCmAx.exe
  2⤵
  PID:9040
- C:\Windows\System\ToOgkHG.exe
  C:\Windows\System\ToOgkHG.exe
  2⤵
  PID:9064
- C:\Windows\System\gGomcBf.exe
  C:\Windows\System\gGomcBf.exe
  2⤵
  PID:9092
- C:\Windows\System\nwUZoAi.exe
  C:\Windows\System\nwUZoAi.exe
  2⤵
  PID:9112
- C:\Windows\System\SvNRuFy.exe
  C:\Windows\System\SvNRuFy.exe
  2⤵
  PID:9180
- C:\Windows\System\buvfpSj.exe
  C:\Windows\System\buvfpSj.exe
  2⤵
  PID:5420
- C:\Windows\System\HxbEItH.exe
  C:\Windows\System\HxbEItH.exe
  2⤵
  PID:8288
- C:\Windows\System\UAwmxNc.exe
  C:\Windows\System\UAwmxNc.exe
  2⤵
  PID:7956
- C:\Windows\System\whIZtJG.exe
  C:\Windows\System\whIZtJG.exe
  2⤵
  PID:8332
- C:\Windows\System\LmIcXOu.exe
  C:\Windows\System\LmIcXOu.exe
  2⤵
  PID:8404
- C:\Windows\System\sGGFXme.exe
  C:\Windows\System\sGGFXme.exe
  2⤵
  PID:8748
- C:\Windows\System\ybYMkSv.exe
  C:\Windows\System\ybYMkSv.exe
  2⤵
  PID:8648
- C:\Windows\System\ekQvQyX.exe
  C:\Windows\System\ekQvQyX.exe
  2⤵
  PID:9228
- C:\Windows\System\CAqPkGy.exe
  C:\Windows\System\CAqPkGy.exe
  2⤵
  PID:9368
- C:\Windows\System\ruRgtOn.exe
  C:\Windows\System\ruRgtOn.exe
  2⤵
  PID:9436
- C:\Windows\System\ceqnGyx.exe
  C:\Windows\System\ceqnGyx.exe
  2⤵
  PID:9504
- C:\Windows\System\LEhnTrx.exe
  C:\Windows\System\LEhnTrx.exe
  2⤵
  PID:9548
- C:\Windows\System\eaQKMbv.exe
  C:\Windows\System\eaQKMbv.exe
  2⤵
  PID:9604
- C:\Windows\System\tBDamfy.exe
  C:\Windows\System\tBDamfy.exe
  2⤵
  PID:9656
- C:\Windows\System\BWRDLzW.exe
  C:\Windows\System\BWRDLzW.exe
  2⤵
  PID:9708
- C:\Windows\System\MufuKfP.exe
  C:\Windows\System\MufuKfP.exe
  2⤵
  PID:9752
- C:\Windows\System\ElvPQbP.exe
  C:\Windows\System\ElvPQbP.exe
  2⤵
  PID:9832
- C:\Windows\System\skCgbDX.exe
  C:\Windows\System\skCgbDX.exe
  2⤵
  PID:9876
- C:\Windows\System\fgZapNK.exe
  C:\Windows\System\fgZapNK.exe
  2⤵
  PID:9940
- C:\Windows\System\JawWnyn.exe
  C:\Windows\System\JawWnyn.exe
  2⤵
  PID:10008
- C:\Windows\System\nvbdVvT.exe
  C:\Windows\System\nvbdVvT.exe
  2⤵
  PID:9912
- C:\Windows\System\UnHTZqe.exe
  C:\Windows\System\UnHTZqe.exe
  2⤵
  PID:10168
- C:\Windows\System\huhjpBy.exe
  C:\Windows\System\huhjpBy.exe
  2⤵
  PID:10236
- C:\Windows\System\gJydvcV.exe
  C:\Windows\System\gJydvcV.exe
  2⤵
  PID:8768
- C:\Windows\System\uiXwBwg.exe
  C:\Windows\System\uiXwBwg.exe
  2⤵
  PID:8276
- C:\Windows\System\COrMXXA.exe
  C:\Windows\System\COrMXXA.exe
  2⤵
  PID:8724
- C:\Windows\System\ckCJgRs.exe
  C:\Windows\System\ckCJgRs.exe
  2⤵
  PID:9812
- C:\Windows\System\jvRecid.exe
  C:\Windows\System\jvRecid.exe
  2⤵
  PID:7744
- C:\Windows\System\bgtjBRW.exe
  C:\Windows\System\bgtjBRW.exe
  2⤵
  PID:9768
- C:\Windows\System\mMAJxXC.exe
  C:\Windows\System\mMAJxXC.exe
  2⤵
  PID:9928
- C:\Windows\System\HufCfwQ.exe
  C:\Windows\System\HufCfwQ.exe
  2⤵
  PID:9516
- C:\Windows\System\vJGKhxP.exe
  C:\Windows\System\vJGKhxP.exe
  2⤵
  PID:9596
- C:\Windows\System\akZClbh.exe
  C:\Windows\System\akZClbh.exe
  2⤵
  PID:10216
- C:\Windows\System\TNgbnzq.exe
  C:\Windows\System\TNgbnzq.exe
  2⤵
  PID:8548
- C:\Windows\System\MqUGpzb.exe
  C:\Windows\System\MqUGpzb.exe
  2⤵
  PID:8668
- C:\Windows\System\HzKAKey.exe
  C:\Windows\System\HzKAKey.exe
  2⤵
  PID:9308
- C:\Windows\System\vVKtKia.exe
  C:\Windows\System\vVKtKia.exe
  2⤵
  PID:9332
- C:\Windows\System\ziCjkiY.exe
  C:\Windows\System\ziCjkiY.exe
  2⤵
  PID:9388
- C:\Windows\System\fIqoChA.exe
  C:\Windows\System\fIqoChA.exe
  2⤵
  PID:9452
- C:\Windows\System\wMYjfJf.exe
  C:\Windows\System\wMYjfJf.exe
  2⤵
  PID:9636
- C:\Windows\System\OhXGcCe.exe
  C:\Windows\System\OhXGcCe.exe
  2⤵
  PID:9852
- C:\Windows\System\HCRHVJW.exe
  C:\Windows\System\HCRHVJW.exe
  2⤵
  PID:10020
- C:\Windows\System\IVOUOEC.exe
  C:\Windows\System\IVOUOEC.exe
  2⤵
  PID:8700
- C:\Windows\System\zfKGLxR.exe
  C:\Windows\System\zfKGLxR.exe
  2⤵
  PID:8536
- C:\Windows\System\vgzJRHt.exe
  C:\Windows\System\vgzJRHt.exe
  2⤵
  PID:9404
- C:\Windows\System\okIFlbl.exe
  C:\Windows\System\okIFlbl.exe
  2⤵
  PID:9108
- C:\Windows\System\VqnuqJC.exe
  C:\Windows\System\VqnuqJC.exe
  2⤵
  PID:8936
- C:\Windows\System\CTjQJCo.exe
  C:\Windows\System\CTjQJCo.exe
  2⤵
  PID:8868
- C:\Windows\System\iAJTZOn.exe
  C:\Windows\System\iAJTZOn.exe
  2⤵
  PID:9652
- C:\Windows\System\tOCvNTM.exe
  C:\Windows\System\tOCvNTM.exe
  2⤵
  PID:9748
- C:\Windows\System\ahyQRvu.exe
  C:\Windows\System\ahyQRvu.exe
  2⤵
  PID:9872
- C:\Windows\System\NTEVKzE.exe
  C:\Windows\System\NTEVKzE.exe
  2⤵
  PID:10108
- C:\Windows\System\OIOlMJr.exe
  C:\Windows\System\OIOlMJr.exe
  2⤵
  PID:10044
- C:\Windows\System\oKQVleV.exe
  C:\Windows\System\oKQVleV.exe
  2⤵
  PID:8916
- C:\Windows\System\xGGZDPp.exe
  C:\Windows\System\xGGZDPp.exe
  2⤵
  PID:9724
- C:\Windows\System\OhYgfhT.exe
  C:\Windows\System\OhYgfhT.exe
  2⤵
  PID:10088
- C:\Windows\System\IJXVZuF.exe
  C:\Windows\System\IJXVZuF.exe
  2⤵
  PID:8792
- C:\Windows\System\mkMMMtg.exe
  C:\Windows\System\mkMMMtg.exe
  2⤵
  PID:9484
- C:\Windows\System\sLVXOja.exe
  C:\Windows\System\sLVXOja.exe
  2⤵
  PID:9132
- C:\Windows\System\yRiThsH.exe
  C:\Windows\System\yRiThsH.exe
  2⤵
  PID:10140
- C:\Windows\System\zlIUhas.exe
  C:\Windows\System\zlIUhas.exe
  2⤵
  PID:8932
- C:\Windows\System\UBohHtq.exe
  C:\Windows\System\UBohHtq.exe
  2⤵
  PID:9084
- C:\Windows\System\KLoWeji.exe
  C:\Windows\System\KLoWeji.exe
  2⤵
  PID:9136
- C:\Windows\System\VNHsdLN.exe
  C:\Windows\System\VNHsdLN.exe
  2⤵
  PID:9240
- C:\Windows\System\EGMwUIp.exe
  C:\Windows\System\EGMwUIp.exe
  2⤵
  PID:7732
- C:\Windows\System\ylElQiu.exe
  C:\Windows\System\ylElQiu.exe
  2⤵
  PID:7932
- C:\Windows\System\JzJwZUv.exe
  C:\Windows\System\JzJwZUv.exe
  2⤵
  PID:8220
- C:\Windows\System\wriBPGb.exe
  C:\Windows\System\wriBPGb.exe
  2⤵
  PID:8228
- C:\Windows\System\ZEmdFqP.exe
  C:\Windows\System\ZEmdFqP.exe
  2⤵
  PID:9324
- C:\Windows\System\WhbpXiZ.exe
  C:\Windows\System\WhbpXiZ.exe
  2⤵
  PID:8344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AFgfbJQ.exe

Filesize
1.7MB

MD5
d0e32c7bc81194d13dca8e4f021fd3b7

SHA1
8b23e7d4283f2a08603c7ae7d078403d213cbb11

SHA256
dd94ae304a4a52da64c30dcdd36c417fe7cd6345be5cae5832f90a56f2ccd386

SHA512
7dca66407f90722accba79ace8db9069f69fbcf0538c8504ec35c8553004446d9233a486515b61e71220bc5e8a61aca9330b49607e3ece05944064a454a2479c

Download Submit
C:\Windows\system\CMGYPNv.exe

Filesize
1.7MB

MD5
c088b25cfa4c7f5f0b2bbbd61ab9808a

SHA1
236be0267e1d1cd4afada487111cad4dc3385e3b

SHA256
642520ad72316214687a4f2eb0459214d890d3effe614d55db6e5d77d0463da8

SHA512
9cb2e632778964dddac5d68d982c9f52c6b8a6032cb45fd4d84b2bde6c1da630a01370298d16e39bc071060a08a8ebf7650077129575cc41d84c37ce83c3ad12

Download Submit
C:\Windows\system\KUgaWkS.exe

Filesize
1.7MB

MD5
ae606e475dd0f60047fd6864a485b380

SHA1
9920508c13ce7c475536a3b03bac53a1cb2848a1

SHA256
5031eff394e32146b4df3a7253a7b2ff3e313f737fcde6c70a7f202c4df2b894

SHA512
db0addcc1ddc1be074e8f4c3305dfa9882fc9c63ac55902deced2c16bc4c935095bf035fc02f044fc53028de1cb52383d306e7752913776e92c052f643e06b4b

Download Submit
C:\Windows\system\NbCJENU.exe

Filesize
1.7MB

MD5
25d71269c83c41025fef1f1f925fa001

SHA1
dbde27415271398566ddca3fbcc97a14a2be7de9

SHA256
c927c9276e78ce700653ad810c49047f04273262be4f7409aa2d836d143b6bb0

SHA512
ae3ea7cc3e4b2df10aceff5149bdafa1eaa64e6e314acbbcfba7afe104383ced24e9a5417a52610deb52a33efd1e0756b47fa61233dbb36355e43d15c6f63564

Download Submit
C:\Windows\system\OLkSUvF.exe

Filesize
1.7MB

MD5
110dc98583b2a673e9e4d71287b52100

SHA1
c10a8f44d13b4ece441d7b3ba0ef527915cce950

SHA256
c69643c0e81763a4ca76e9f82d9dddaf20059990d54475924450377299bcf95e

SHA512
3049d2bc6505c641b8ae06d242442717f554224524a26a31c0691fc20f522aa07be8394c7714bd037245b0b2f22285073b5f973e7a51694920f14a45a39ccfa3

Download Submit
C:\Windows\system\OPiKVnD.exe

Filesize
1.7MB

MD5
9042b6feff66b8abe5691d56c98a8fd8

SHA1
a58d3eebe99066a71a7b0c8a5ce5192f46ac1803

SHA256
830e47cfd6ee4a5d7bb7af348789b2e5d8ccdbdea7e53e069b80735cc028a0a9

SHA512
eaa5f5a094c677b15dd62ddc0ab5181216a662bde33e344c64c4c0126216cb449c8a2cca55678fb558193ec53b1afdec34724ffe6c73319bec4d21dda89f30d0

Download Submit
C:\Windows\system\RWQEoly.exe

Filesize
1.7MB

MD5
c0c5889c2a7d10d16ab9f4d83ac85454

SHA1
8324fa1763cdb450f8c487e715a629523bf4862d

SHA256
ec94be0409b4ecdb6bbe178b1acf600d66420da715a52958df4b149794ceafc6

SHA512
447738303b032bb12dd63a385e9907dbd5f36f35cea67e9bd1916d9b1b7a48cb58fc3f8ca05c925674240e7059249921d0da1216ca9e87355b18de247424afcb

Download Submit
C:\Windows\system\SIRFNkA.exe

Filesize
1.7MB

MD5
c95bb94391a7ddd1e0577de8fe8dd98d

SHA1
8f0819ceb431b710c5b4ede2ef30dfb5ea80c8f8

SHA256
687eece9f7ec8d81f6245612a4e8fb94319e61af93f8c887f56d2aaea277c922

SHA512
5769f28dce3bb62e7309c16e6f5469f26b82bd02adc6692d19d8c70fe7321aab1c9cbb6fe08fb6c828aabfe566e2e82058872a67190cbc1f331dfafeaf5ab2d3

Download Submit
C:\Windows\system\SfvGpNB.exe

Filesize
1.7MB

MD5
e070485b833d037e57b37a06a22ce2fa

SHA1
2f538ef58fc81a4ba13ecbb43aa02add817c1c64

SHA256
cc39f556b11ef47d8ec53f514cefd363378f066b7b4fd7a520bed1d682a0f3aa

SHA512
e4cb54feaa210b4e95230e30437c053098f2f553349c0a5b23964a729d26856ef660f233002ac30df84b9dbedf8dd99513672a2a7ac046ea39b7c3922c07403a

Download Submit
C:\Windows\system\XPandJk.exe

Filesize
1.7MB

MD5
3a55e69bd9d31981ade62326af8f2b03

SHA1
2b829bde2f1f3ba9911b688426a1b83ec5fb9250

SHA256
5ddccb596cfa6603de36d17038178ca4e4b5b6ebc2960e93d65bf75397ab1489

SHA512
a9be586f3655b70589380338c95282d833373ebf7651f9c9367a4a402faaa06079c8805b2895021e67645842134fb8366239c8b7bec6f337b984d6c9557e8529

Download Submit
C:\Windows\system\YOZTwNS.exe

Filesize
1.7MB

MD5
e1aa569e8365a7483882f7d7805a6a08

SHA1
a60f4e3518ac2cd0b017ebbcf2e714dcbbc5ff4f

SHA256
f26cef36bc6a49262489659c5a92549f1f58e3b42eaf2e05d75cc1cda4241c85

SHA512
93f1a8ae64b685481f2cc3cf45d522741f514f538ce1aa8fdbc1af19c091e5d5e9f08305813c8efd8ba7be8a8111fcde363b4a596e5a51a800648cf1337087b5

Download Submit
C:\Windows\system\YjicZsp.exe

Filesize
1.7MB

MD5
8034c916896473fdb70a906fc87bd5b9

SHA1
0ec1f4b8d91e736387cfbc8967f96c0e19b11b93

SHA256
a1d6ab2cecb3db53ff96a89ffb8c2c9bd50c56a2dee6c2341b6504328b1a145c

SHA512
70c125848b435a845b0dadc00a6e2d08015f9c24e6a277a7ecac24f526e6d5b91922acbd8917837b062cd240b9261c9fbb1c821fbd805e1580ba356a8e26782e

Download Submit
C:\Windows\system\aDXYNwu.exe

Filesize
1.7MB

MD5
6cbe6eaa6423f9bd43fd1c86f686e535

SHA1
b6b7d38badb87c9004e2d0bee4af084e821f96d7

SHA256
9259fc81f5d0151f27921ec5739a5ba4dbb5cb8b8c8634d500ab4cdec12b0cf3

SHA512
14f400f094efbdc58e92ec61c18fd618905d837b741de039cd891794a14d4b5ad18a6475c70cf3c58ce638754bbb4e0dceba50139abc85237a4ce2673be156ff

Download Submit
C:\Windows\system\cBqTnGl.exe

Filesize
1.7MB

MD5
e4cb0348d8f049438e61c5cd97b36add

SHA1
028542071c2e1a1aa51767b03092540520071c2a

SHA256
eb6a3a5ead6187b8ca6e85648ab50a4ff9582f998e9262d2acff5ec7fbe80ff1

SHA512
569e13c8d644faf76e5c71dbb0fe28ac0c56ffbbc944d91d7eaa9cacb9ad290355a6098e7f23b13f492adc46fe5bf9d668fa6df5d37bb77f030c47e159299132

Download Submit
C:\Windows\system\gRtJISq.exe

Filesize
1.7MB

MD5
7d9ace27e80e1d03545d03e1169a3533

SHA1
9f06fea131872cab668d2a5e3d3d9153d08fc5d3

SHA256
e240d1488cccdc029dd3eb1f5caffb67c62582909927e73eae39e4331788462d

SHA512
cf94184ea23c4f907bb63e25421de5b431a157f1837f4dc2c3f3f41fc87343014e88c4086d806d81fbdb7ddbeb74a9ab9e99f6b841065c00778a5c0b36605c17

Download Submit
C:\Windows\system\mLZersE.exe

Filesize
1.7MB

MD5
4aad490422c5aea58c4288ed5ade2ff4

SHA1
0d57f1d46ecfd923793a90d689cc5016eeb69b52

SHA256
90863112c0c47f8a3c07c70ef6d5ab0c1a63db4f17584442208129b85e84b045

SHA512
890036fcf301c02ab0effd9652dfdfd2de85d89c1ec0e6c3d745cdc7b1fb7bfce33c78a9cf0859a644e2257aa236fa802bfef3030ed6d9aaa4957802363ad5df

Download Submit
C:\Windows\system\pNXGKzA.exe

Filesize
1.7MB

MD5
0e4623f22657804b705fb3e79936dfc8

SHA1
a27fec1ac5e55bb8df91a7bb49e67fac32c5596a

SHA256
d4ee4b459b3a64c8d9ad5765db0ac9f6b9e27e66aa1c784179ff4b44805ac921

SHA512
c1f3d424ef98f024556f064a724373065e53d1e625f6c89471d3828931a999d318f846b31f3445d6b459fa3e3d73246576c330b578d1d6493286591a4b90a744

Download Submit
C:\Windows\system\pwcDRAA.exe

Filesize
1.7MB

MD5
0e6a46a1e8f0bea90c5caad80af6fb0d

SHA1
54b0d46f0216f5d07b3cc8d15d6db13913a7e77b

SHA256
dbd729e221edf349ceb1b09172d7a76683112d5c4cf066b33230b04e2a797716

SHA512
bb277b9ec2b1347d0a2dd5e09c68387dbee2e94bca8168784d390fad82709802ba2139883d4dfa23a4be8c716b89581693a47de3a657776c5488a310c463d15b

Download Submit
C:\Windows\system\rxwPhhf.exe

Filesize
1.7MB

MD5
9f94da29cf17a677ff00b8754d54ec1e

SHA1
2b782a635df244aeba7bda70c6b9db27be8610f4

SHA256
4567661ee18e0df4d19a0ad44e3fbe87667a9dc072378c36816fecb12b110790

SHA512
d7ff54cef8409486fb386cf3ddbb1282c4c707b4579d71b7a4ea82a3f7d546d5086b55d4077dfc9b4d22ae9a2c6fe3fdc458f326aa6fb88c48922ac0c1ebbfb0

Download Submit
C:\Windows\system\sSNfVmO.exe

Filesize
1.7MB

MD5
9fa222d0356d2a3c2566d51c1750ea54

SHA1
23fa6997dff94bd17c43890f62ec2a05a4eba315

SHA256
053b18d2e696f14afc40f0caa7caf4e21450c1bfea342ffba0bb9ffac8a9f2ad

SHA512
c231ad51cc94e9c0158a663803ac4985235d98a8c6d9f1323860361eb9dd2ba92728c0f0c970c75d5cfb556b85cfcfab3f33f116f09ec72e3f96fcb165b75a45

Download Submit
C:\Windows\system\thyKcpc.exe

Filesize
1.7MB

MD5
db9ccb679e77ea8d03052e35bf192a0f

SHA1
9e2ca6643ec66ad5c05170a4e6fad610c7f63601

SHA256
209c5b040ee12cdddea07a3b629ce927c79d22baefeb11bfb1bb22b661817a3a

SHA512
a1856a78772c94a9dbf5d5c069eb10cb82d00b9503201a47e7a03ae900214a3182860bc449e7a008ed11b4161e9642ebc12418ffcf36a2cd3a26657a70477aac

Download Submit
C:\Windows\system\vlPlvWP.exe

Filesize
1.7MB

MD5
9807eb5924cfef9037e68d456df254db

SHA1
6de31f02cbf6d5e6228e69f47929e2373028f5af

SHA256
e62b00302c391cb09cd4e327e77ac4d07ae6ce95954f512de0e41e1c344cb195

SHA512
4fa53adb8738a793a44050ce0c22558a9b80a0cbcf10350ba195868f6a49c4fcb0af71dbf707fcfd88155e9fe6c584a1749d701bc24821b57b8a43fe0936e624

Download Submit
\Windows\system\BCZJORo.exe

Filesize
1.7MB

MD5
8ad8bdff4d024c3d8d4eb914d1fd310b

SHA1
acb6b0a08540b14f7705ffb83a3012922c706a30

SHA256
b370a0fcd74234cee0a8e530ef2f9c6e5c194ebf3c3528de14a6ea85d325d6c8

SHA512
8758e8287225ef5b9a882e8526ccd3883e026840cee3e0bea4636ecd3e522ac71885cdd4fbb46160d1cda82e153c2dd7c14c9e65be6e2601d2d87bba6483f781

Download Submit
\Windows\system\CJCTLjW.exe

Filesize
1.7MB

MD5
702f0fb110e636406e5e78acdacc838e

SHA1
1ea068f606378554e55c1c7e4edcca8219b1f15d

SHA256
6f17f01b83c9052a36832c9623ac28e9b392e0e846c539d2e7d84a0c45e9f7e0

SHA512
cddfb506a6ce5153bdea6262365ff7d278ad31ed23292bd00055970fd1fcab1052487999ce401cc4516c4585f973c99f8c9aedfa768c79c4993a53e0053705c4

Download Submit
\Windows\system\CKeMaDh.exe

Filesize
1.7MB

MD5
ef5a9a61316deb30279d21c35010484e

SHA1
57a5aca42dbeffc5d0a741ed6388567757ac6cad

SHA256
fb69c4116347eaf7af74757345eedcfbee496bf7f01a45942094ca0b5ba709c3

SHA512
d2771c01f4ce3e8a53fe267cb5f185af54cfc2eb58d64a002bed9e3cf7cfa1c41812a6b99ebed2c4219f53ae7632d1394c09d53732ce1abdbbbb9589df3d8fce

Download Submit
\Windows\system\FJrCxLA.exe

Filesize
1.7MB

MD5
b0854675d0440e946234e80212a111ac

SHA1
6769ee276a9c51aa0dc14db2ba578c192b289ec2

SHA256
d05822ca647b6f69a394ebf5589ea499457868b470e83e2572f3fa5f28e48291

SHA512
303345cfd087e03faaf235ae2dcd9f8be5505c0b188c75d3c8fbc9b9adbdae53181bc110e7f7e0dca84e6f0f7a8be7fec65b0d3e3690005f2c03518cdd8e2023

Download Submit
\Windows\system\FpAnBPL.exe

Filesize
1.7MB

MD5
71903cc1eccd199b3040de7c43cce72e

SHA1
d45f61cf114c32af482eb30afcac515834954e28

SHA256
4c9bf3c6ffff16be4a20202502c76a1824226c90a3a9cd7fd8d5a0b3e454e67d

SHA512
49e40ce14c9ce3ab6a1857ea496f300d9a638b6282d68f54f98578850e2000f4aadf9a217bdfe8afc4b13077a1a282441223c587c1a5170bb37068bdfd67a0b8

Download Submit
\Windows\system\JcWxorw.exe

Filesize
1.7MB

MD5
35dd75c02c2bd3001686d9ef95fdcb94

SHA1
5398994c2501fd3c0ffef2c8272f67c650d917f7

SHA256
50859a2c1e0f6cf0ace5e8621a7d155813d912c147d1fa869cb28511aa6c0a5d

SHA512
eb3c2f1e3951a908486917a36e546fabad593164275cee0b44a87fb6837b8ea13522bac31e2655ed072482a39aff00b851cd5c1e1d2b7ae4e5b7681a39f4a031

Download Submit
\Windows\system\KEHsyQm.exe

Filesize
1.7MB

MD5
995cd4a8a96e1930396f302f77f33d04

SHA1
8cc3cf658000c3e9977e2fef7166fff63e73b66a

SHA256
c368b3760137ef3f5f0ee8e40f77ca937b6618182419a3893d0e0a158b6fac14

SHA512
96a1b27dd9da4b9c337ecd8c5b0df4acdd483e8444a1815b62cde08ad417ca142e2c8163d2582155233e66051a6765935ce5b056ded56f7dee9df3ff0c4f63cc

Download Submit
\Windows\system\TBnGFKx.exe

Filesize
1.7MB

MD5
e7be0414cc118f8bde8fefbab5359f09

SHA1
0b459d562629d43a16a346fcdf8b3ba6a9549cd0

SHA256
e34f14ab1fc59a1fe59d1dc39d5d3c40eeed26dde8e15bb4217e15877ad8865c

SHA512
daedd91f785e59e3fd7def2de941bf1a174e4f248409b27946c5725cd199208f298d9da534fd32fc466dcd653e46af5a36ed7406d0277cae415f739881414651

Download Submit
\Windows\system\XuRLRiM.exe

Filesize
1.7MB

MD5
a607bc7b70eb4a2a2c40f77042471fc4

SHA1
5978dc9c17d6c133fbdf69f0909b03aa02868670

SHA256
502abac72372c1c08919c3075d2b8036ef890c491ea8207d9afbe0923fc35e77

SHA512
0eb059fa0d778880e887da7b1ece9594ef108f8e31c42f0000d7ece9e6847d54eed3d3e4aebfac514e6709f2f29e036eaa908339d17d3f7e239c4f1107655199

Download Submit
\Windows\system\aTvhrPJ.exe

Filesize
1.7MB

MD5
0f74a7206e4073c59cb497f824bd1e8c

SHA1
f388cedeb70c99739b87659f09f28b1dad6c7f20

SHA256
bd362ce5bcda0abe8c504dbeebae0783d57a3ea37f7f599fe9e3d4585eb69c37

SHA512
48a9f189366da6b931d1d48ea35f9d29f71121df67fb783dfa0ec82622c8720ef5a1807733ea79f5eb02cefdcba33569236248324f183d5b5efc9ee452acd2b6

Download Submit
\Windows\system\bPpSoKx.exe

Filesize
1.7MB

MD5
2b08c89776fb0877a86ae04522d0aaa8

SHA1
d7d93ba4b639992e27da39b66a69a870e08e3ef8

SHA256
c4da9db34d73b57fb692539b487311a5d78031553d09e2f7ac8251126767e4bb

SHA512
ba3c4c0b9dc8a6bfd15837eb1a104083282e26d03a4edcc6660d779969ffb3c8ee60aae7bd1a910341fb9a1d99e5a088238d7a55069c25a78a03cf445816b8ce

Download Submit
\Windows\system\fsykfIw.exe

Filesize
1.7MB

MD5
ab12fbc7a3a4bec0403e06bb14702275

SHA1
bfaa806252ef3ddda4c63943fa405b48e2807fe0

SHA256
f3a9b6084e98ec649b38cd802a48707486f34c270c86d625b4ce392311a8cc94

SHA512
794d904690a4744019d4e829d969fe8ec06d406edb761f16c7ece1469ccd7b820829f08207c2ff48399a15ae63c40e891c2d694f4cf4574b25c745c093ffa100

Download Submit
\Windows\system\ibHzuDU.exe

Filesize
1.7MB

MD5
12db9336aa452465e569adddbba9fa65

SHA1
226e951b682aa5f54a7ab2f9db050011e16ddc9b

SHA256
5e5ad4931a348c5904cb296b6f1817cc3376721ceb6202f7da7c0e25a688f127

SHA512
d68341098e3ee8d159b4a99eb0c571a078ca7a6f3646ede40c1e960bc9de7361de6a7d35decc0e3ca1f3aa8908a2d428f573bf8ad09eaf535115d27f12bf54b0

Download Submit
\Windows\system\jhhMvIb.exe

Filesize
1.7MB

MD5
86076dc96a1759f537ba830613b6d1a3

SHA1
78e662bad6269d343ca5a8b7e6f2b7352e62bd5f

SHA256
b8824dcff74190176a3130c9701fd65573e260295443ae5c71d5cb6752dad1fc

SHA512
51d3b6d931130c3c55f3695e7333ed3b3f20be4c0f23ca7baedacccdec9824578694f2ad87e0f3244ec26962d49fd2182a21681bda56e3ae8d847a8f3a34feb4

Download Submit
\Windows\system\kkLtsqS.exe

Filesize
1.7MB

MD5
47568119f70745ad4578c6d899933c25

SHA1
e42c65f35ca3f5fe0a72cfd4cd2801694ee21e2a

SHA256
7c70863b182c48e92fe04ba41d3eeed187e1846b1247f360941d43bd2d2f0b8c

SHA512
f028f24960f06627a06de3fd4ac4b5ad7d830480b5deee993b5be28da0570631ac78f7878067ff0cae549ee2bb29e81d181911f0d22bccb2bcd4482cd613a357

Download Submit
\Windows\system\miHQWRl.exe

Filesize
1.7MB

MD5
5610fc04a2984cfa9b088763842ecf73

SHA1
6e75547baca3be488239883cbb8b60fba0e8e0b5

SHA256
f16a68f02ebfc04586daefded478b02d7090ce766ccd0ce5bb29a74e3cb945e2

SHA512
ed377e5068470d9fb61fca6348b4903078ac4070168780ea68b8e3165e5829bf06f93b766c7da7aaf7b71cd92b5778bafb38e458c306ae905a53daeaf1e44481

Download Submit
\Windows\system\pRAlTUZ.exe

Filesize
1.7MB

MD5
912a647c7e00307ee968e1e9b3258459

SHA1
5ffe39433068a12b4ac1acbd4c145fb5752fe92d

SHA256
19007612e72da930ce17e22f7b4fd72401be2b73347ce64e0021db70fc76798d

SHA512
d57a7c776da0b3f6bd45f5e58821e4875832c8e159b82a12dc8fa72045ef11632f794ff8ad6d5d57446a01f19d2f6a892a41f2b1e172a73122f60c2a4dae8892

Download Submit
\Windows\system\qLaklWE.exe

Filesize
1.7MB

MD5
154b7962276cc3ecaf9ffb1a5bd5f9b7

SHA1
6b2eced019277abb1860264e8d116f54199d84fe

SHA256
1c8b39ebd23e2ec52b13bf979bcb4650c283abce8938f2af783a27cf29d75ec5

SHA512
367d426c520c9edde4b269bcc618aebc9b7f5ae7758c35bbe877eadda15b4828399a6611c876bfc3685de9aa8b10d3b8d2b71fb70eeb7a7ba403ec900721f312

Download Submit
\Windows\system\tfJRChN.exe

Filesize
1.7MB

MD5
970023b8519260d7d8352ea798089328

SHA1
1234b10cb61cc6846fdde670a4240edf2883a222

SHA256
e37c4ec651df404bbd14d50f3a833a2b577f1c91aade5990d66c77b3efc2fe5f

SHA512
f8aa0b10b81f184a03f4b04d89ad96d06ccb957d63f0bf92dc6b947feec2d91fad91bcfb5ec35ea9d0d5d9f2fd7ee0b9528239ef5942c7178ab731387fd1f4ea

Download Submit
memory/1572-4179-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/1572-86-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/1796-4187-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1796-34-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-277-0x0000000001E90000-0x0000000001E98000-memory.dmp

Filesize
32KB

Download
memory/1840-276-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/1856-73-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/1856-4166-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2156-39-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2156-52-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-41-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2156-46-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2156-6-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2156-53-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-11-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2156-51-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-50-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2156-109-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2156-29-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-20-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2156-1481-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2260-15-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2260-4192-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2284-4195-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2284-113-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2568-92-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-4183-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-4174-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2788-4190-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2788-79-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2804-97-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2804-4170-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download