xmrig | b5082b670081e3704c26423bbad36b6c1ff00f296f088ed83218c1e6daa642cb

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
Size

1.7MB
MD5

2069be33c575e608f01bafe25c281371
SHA1

9456fa711f0aa3237c56db95b28927d02effea84
SHA256

b5082b670081e3704c26423bbad36b6c1ff00f296f088ed83218c1e6daa642cb
SHA512

e2158fa82ade2a4783fb3b3bbe634fb66eb73aeb3b1f7c1455f15f79fd5d9a057303e7bd1691d55517b98e0f511b6a7e76ea8ed381d1f73db9b3df83795c2364
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtj:Lz071uv4BPMkibTIA5I4TNrpDGgDQzlB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2768-186-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2396-194-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2908-206-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2620-208-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2436-205-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2144-204-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/2904-203-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/1924-199-0x0000000003620000-0x0000000003A12000-memory.dmp	xmrig
behavioral1/memory/2556-188-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/1940-180-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2604-174-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2672-20-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2604-4895-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2396-4951-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2904-4964-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2620-4961-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2908-4959-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2144-4958-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/2556-4953-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2436-4956-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/1940-5087-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/1924-6328-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1724	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2916	uMePNDT.exe
2672	EYfErSo.exe
2604	ctedPmx.exe
1940	KzvdJir.exe
2768	qBAFrGp.exe
2556	zfLXNCZ.exe
2396	ZoOebmC.exe
2904	JsCkvOp.exe
2144	ZKgLJoj.exe
2436	OvzLEzq.exe
2908	LyNiJxe.exe
2620	EvzvgAO.exe
2568	JHGDyvQ.exe
2760	JfmdGVQ.exe
2792	BGCoRVT.exe
2800	tgaVnCP.exe
1516	OkbbYrU.exe
1776	eNYpmsB.exe
2276	akupQAc.exe
2348	HbCCKbX.exe
1236	RkaXmZQ.exe
2892	GNoQUTF.exe
2640	SgyprKt.exe
1672	KndNaiV.exe
2044	ZVTrOGw.exe
1340	BkfqXuO.exe
528	jqxJEAA.exe
576	aBXOERE.exe
2836	XJdQThp.exe
2776	BJIeXPC.exe
652	qFXBYxC.exe
452	vkRuycX.exe
860	WjQvErZ.exe
1688	GXxfIWR.exe
1780	GkYBwDC.exe
1668	GlNgVQc.exe
2084	vkeIrHh.exe
1900	FDeDCXe.exe
2984	qvtsJLm.exe
2840	VUhKTNX.exe
968	WYmGTjw.exe
2308	gtBRRON.exe
2948	HtJidcE.exe
2180	RZgiqKK.exe
1408	jKVraqO.exe
2316	iODvcQN.exe
1496	mInbgoX.exe
2572	LsJhMmV.exe
2696	jNSPKUs.exe
2444	odavoaC.exe
2204	prCDaMq.exe
2468	ZGXquNy.exe
2312	ficfErC.exe
1696	pvrcqrq.exe
2296	BOtYZne.exe
2752	SgfeUOc.exe
1524	BfpSyIE.exe
2664	evQStVz.exe
2480	thnyhqS.exe
2648	DuOozwq.exe
1700	RLgLhjZ.exe
852	fQqnWmP.exe
2040	bdOpRSe.exe
1552	RyyoTjP.exe

Loads dropped DLL 64 IoCs

pid	Process
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1924-1-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x000b000000015bb9-3.dat	upx
behavioral1/memory/2916-8-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/files/0x0038000000015ca5-13.dat	upx
behavioral1/files/0x001400000000549e-22.dat	upx
behavioral1/files/0x0007000000015cf7-34.dat	upx
behavioral1/files/0x0008000000015cec-29.dat	upx
behavioral1/files/0x0007000000015d06-37.dat	upx
behavioral1/files/0x0007000000016c2e-61.dat	upx
behavioral1/files/0x0006000000016ced-73.dat	upx
behavioral1/files/0x0006000000016cfe-80.dat	upx
behavioral1/files/0x0006000000016d0e-90.dat	upx
behavioral1/files/0x0006000000016d67-130.dat	upx
behavioral1/files/0x0006000000016d27-104.dat	upx
behavioral1/files/0x0006000000017458-162.dat	upx
behavioral1/memory/2768-186-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2396-194-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2908-206-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2620-208-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x0006000000017387-158.dat	upx
behavioral1/files/0x0006000000017465-164.dat	upx
behavioral1/files/0x0006000000017185-148.dat	upx
behavioral1/memory/2436-205-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2144-204-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/2904-203-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2556-188-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/1940-180-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2604-174-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/files/0x0006000000017474-169.dat	upx
behavioral1/files/0x0006000000017384-153.dat	upx
behavioral1/files/0x0006000000017060-143.dat	upx
behavioral1/files/0x0006000000016f82-139.dat	upx
behavioral1/files/0x0006000000016d4b-137.dat	upx
behavioral1/files/0x0006000000016d40-127.dat	upx
behavioral1/files/0x0006000000016d17-99.dat	upx
behavioral1/files/0x0006000000016d44-121.dat	upx
behavioral1/files/0x0006000000016d06-89.dat	upx
behavioral1/files/0x0006000000016d3b-109.dat	upx
behavioral1/files/0x0006000000016d1f-103.dat	upx
behavioral1/files/0x0006000000016cf5-78.dat	upx
behavioral1/files/0x0006000000016ce1-69.dat	upx
behavioral1/files/0x0006000000016cab-51.dat	upx
behavioral1/files/0x0006000000016cc9-58.dat	upx
behavioral1/files/0x0006000000016c7a-57.dat	upx
behavioral1/files/0x0008000000015d6e-43.dat	upx
behavioral1/memory/2672-20-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2604-4895-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2396-4951-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2904-4964-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2620-4961-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2908-4959-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2144-4958-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/2556-4953-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2436-4956-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/1940-5087-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/1924-6328-0x000000013F430000-0x000000013F822000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nRXJhZe.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\YWgxsWD.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\SszdCAg.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\accDrqU.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\CNQhRZE.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\hsASERp.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\qBFFWsY.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\GuXJTGy.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\tqVBllt.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\qSLgbxI.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\dBqxtqo.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\IKpQZFP.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\egHPMOI.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\SyRTPns.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\uLJgKwh.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\yPdXtni.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\dIEgcDm.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\AUZGxnY.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\SqFbftb.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\ZjsfFIq.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\DwDFzvl.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\ieLnHXB.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\rhVkGOL.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\RdxsamE.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\uBzwDAN.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\ianNUop.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\ORZavBb.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\TszuXVs.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\UkrsbxW.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\XZazatU.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\xKtmXsS.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\FSaFelr.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\alnDHnq.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\waPczgR.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\RzxPaDo.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\jsZMwBu.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\bTymStq.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\ZLJulgx.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\yBfSKXh.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\QcADozG.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\nsMvWKa.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\FIuoTuJ.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\uGCdpBF.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\bmmpBUj.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\FSGkLZN.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\XnhIzbD.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\ssUQvZu.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\myzjrET.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\MYRqckz.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\urBZRYi.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\vUpLFfK.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\RGiVDRP.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\cwhwYPI.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\QrglleL.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\fjVQBwa.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\KGcFPAQ.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\RChqYDC.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\bXXLXfE.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\rNSuAVk.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\sQFoNlY.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\oUEaYaD.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\haavNpZ.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\tcyDwGK.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
File created	C:\Windows\System\HfUzVSY.exe	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1724	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
Token: SeDebugPrivilege	1724	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1724	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	29
PID 1924 wrote to memory of 1724	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	29
PID 1924 wrote to memory of 1724	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	29
PID 1924 wrote to memory of 2916	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2916	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2916	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2672	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2672	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2672	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	31
PID 1924 wrote to memory of 2604	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	32
PID 1924 wrote to memory of 2604	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	32
PID 1924 wrote to memory of 2604	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	32
PID 1924 wrote to memory of 1940	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	33
PID 1924 wrote to memory of 1940	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	33
PID 1924 wrote to memory of 1940	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	33
PID 1924 wrote to memory of 2768	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	34
PID 1924 wrote to memory of 2768	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	34
PID 1924 wrote to memory of 2768	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	34
PID 1924 wrote to memory of 2556	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	35
PID 1924 wrote to memory of 2556	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	35
PID 1924 wrote to memory of 2556	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	35
PID 1924 wrote to memory of 2396	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	36
PID 1924 wrote to memory of 2396	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	36
PID 1924 wrote to memory of 2396	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	36
PID 1924 wrote to memory of 2436	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	37
PID 1924 wrote to memory of 2436	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	37
PID 1924 wrote to memory of 2436	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	37
PID 1924 wrote to memory of 2904	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	38
PID 1924 wrote to memory of 2904	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	38
PID 1924 wrote to memory of 2904	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	38
PID 1924 wrote to memory of 2908	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	39
PID 1924 wrote to memory of 2908	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	39
PID 1924 wrote to memory of 2908	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	39
PID 1924 wrote to memory of 2144	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	40
PID 1924 wrote to memory of 2144	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	40
PID 1924 wrote to memory of 2144	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	40
PID 1924 wrote to memory of 2620	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	41
PID 1924 wrote to memory of 2620	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	41
PID 1924 wrote to memory of 2620	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	41
PID 1924 wrote to memory of 2568	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	42
PID 1924 wrote to memory of 2568	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	42
PID 1924 wrote to memory of 2568	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	42
PID 1924 wrote to memory of 2760	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	43
PID 1924 wrote to memory of 2760	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	43
PID 1924 wrote to memory of 2760	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	43
PID 1924 wrote to memory of 2792	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	44
PID 1924 wrote to memory of 2792	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	44
PID 1924 wrote to memory of 2792	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	44
PID 1924 wrote to memory of 2800	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	45
PID 1924 wrote to memory of 2800	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	45
PID 1924 wrote to memory of 2800	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	45
PID 1924 wrote to memory of 1516	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	46
PID 1924 wrote to memory of 1516	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	46
PID 1924 wrote to memory of 1516	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	46
PID 1924 wrote to memory of 1776	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	47
PID 1924 wrote to memory of 1776	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	47
PID 1924 wrote to memory of 1776	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	47
PID 1924 wrote to memory of 2276	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	48
PID 1924 wrote to memory of 2276	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	48
PID 1924 wrote to memory of 2276	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	48
PID 1924 wrote to memory of 1236	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	49
PID 1924 wrote to memory of 1236	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	49
PID 1924 wrote to memory of 1236	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	49
PID 1924 wrote to memory of 2348	1924	2069be33c575e608f01bafe25c281371_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\2069be33c575e608f01bafe25c281371_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2069be33c575e608f01bafe25c281371_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\System\uMePNDT.exe
  C:\Windows\System\uMePNDT.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\EYfErSo.exe
  C:\Windows\System\EYfErSo.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ctedPmx.exe
  C:\Windows\System\ctedPmx.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\KzvdJir.exe
  C:\Windows\System\KzvdJir.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\qBAFrGp.exe
  C:\Windows\System\qBAFrGp.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\zfLXNCZ.exe
  C:\Windows\System\zfLXNCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\ZoOebmC.exe
  C:\Windows\System\ZoOebmC.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\OvzLEzq.exe
  C:\Windows\System\OvzLEzq.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\JsCkvOp.exe
  C:\Windows\System\JsCkvOp.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\LyNiJxe.exe
  C:\Windows\System\LyNiJxe.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\ZKgLJoj.exe
  C:\Windows\System\ZKgLJoj.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\EvzvgAO.exe
  C:\Windows\System\EvzvgAO.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\JHGDyvQ.exe
  C:\Windows\System\JHGDyvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\JfmdGVQ.exe
  C:\Windows\System\JfmdGVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\BGCoRVT.exe
  C:\Windows\System\BGCoRVT.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\tgaVnCP.exe
  C:\Windows\System\tgaVnCP.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\OkbbYrU.exe
  C:\Windows\System\OkbbYrU.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\eNYpmsB.exe
  C:\Windows\System\eNYpmsB.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\akupQAc.exe
  C:\Windows\System\akupQAc.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\RkaXmZQ.exe
  C:\Windows\System\RkaXmZQ.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\HbCCKbX.exe
  C:\Windows\System\HbCCKbX.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\SgyprKt.exe
  C:\Windows\System\SgyprKt.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\GNoQUTF.exe
  C:\Windows\System\GNoQUTF.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\ZVTrOGw.exe
  C:\Windows\System\ZVTrOGw.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\KndNaiV.exe
  C:\Windows\System\KndNaiV.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\BkfqXuO.exe
  C:\Windows\System\BkfqXuO.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\jqxJEAA.exe
  C:\Windows\System\jqxJEAA.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\aBXOERE.exe
  C:\Windows\System\aBXOERE.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\XJdQThp.exe
  C:\Windows\System\XJdQThp.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\BJIeXPC.exe
  C:\Windows\System\BJIeXPC.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\qFXBYxC.exe
  C:\Windows\System\qFXBYxC.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\FDeDCXe.exe
  C:\Windows\System\FDeDCXe.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\vkRuycX.exe
  C:\Windows\System\vkRuycX.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\qvtsJLm.exe
  C:\Windows\System\qvtsJLm.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\WjQvErZ.exe
  C:\Windows\System\WjQvErZ.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\VUhKTNX.exe
  C:\Windows\System\VUhKTNX.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\GXxfIWR.exe
  C:\Windows\System\GXxfIWR.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\WYmGTjw.exe
  C:\Windows\System\WYmGTjw.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\GkYBwDC.exe
  C:\Windows\System\GkYBwDC.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\RZgiqKK.exe
  C:\Windows\System\RZgiqKK.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\GlNgVQc.exe
  C:\Windows\System\GlNgVQc.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\iODvcQN.exe
  C:\Windows\System\iODvcQN.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\vkeIrHh.exe
  C:\Windows\System\vkeIrHh.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\prCDaMq.exe
  C:\Windows\System\prCDaMq.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\gtBRRON.exe
  C:\Windows\System\gtBRRON.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\ficfErC.exe
  C:\Windows\System\ficfErC.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\HtJidcE.exe
  C:\Windows\System\HtJidcE.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\pvrcqrq.exe
  C:\Windows\System\pvrcqrq.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\jKVraqO.exe
  C:\Windows\System\jKVraqO.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\BOtYZne.exe
  C:\Windows\System\BOtYZne.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\mInbgoX.exe
  C:\Windows\System\mInbgoX.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\BfpSyIE.exe
  C:\Windows\System\BfpSyIE.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\LsJhMmV.exe
  C:\Windows\System\LsJhMmV.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\evQStVz.exe
  C:\Windows\System\evQStVz.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\jNSPKUs.exe
  C:\Windows\System\jNSPKUs.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\thnyhqS.exe
  C:\Windows\System\thnyhqS.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\odavoaC.exe
  C:\Windows\System\odavoaC.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\DuOozwq.exe
  C:\Windows\System\DuOozwq.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\ZGXquNy.exe
  C:\Windows\System\ZGXquNy.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\RLgLhjZ.exe
  C:\Windows\System\RLgLhjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\SgfeUOc.exe
  C:\Windows\System\SgfeUOc.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\fQqnWmP.exe
  C:\Windows\System\fQqnWmP.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\bdOpRSe.exe
  C:\Windows\System\bdOpRSe.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\RyyoTjP.exe
  C:\Windows\System\RyyoTjP.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\JEgkuym.exe
  C:\Windows\System\JEgkuym.exe
  2⤵
  PID:628
- C:\Windows\System\qjeDrlW.exe
  C:\Windows\System\qjeDrlW.exe
  2⤵
  PID:2000
- C:\Windows\System\uhErCsy.exe
  C:\Windows\System\uhErCsy.exe
  2⤵
  PID:2192
- C:\Windows\System\xYcrAmW.exe
  C:\Windows\System\xYcrAmW.exe
  2⤵
  PID:2972
- C:\Windows\System\XfDYUZW.exe
  C:\Windows\System\XfDYUZW.exe
  2⤵
  PID:1680
- C:\Windows\System\iFwdeQJ.exe
  C:\Windows\System\iFwdeQJ.exe
  2⤵
  PID:1932
- C:\Windows\System\urtfyjr.exe
  C:\Windows\System\urtfyjr.exe
  2⤵
  PID:788
- C:\Windows\System\cedqGXu.exe
  C:\Windows\System\cedqGXu.exe
  2⤵
  PID:1640
- C:\Windows\System\fWsoXfX.exe
  C:\Windows\System\fWsoXfX.exe
  2⤵
  PID:1164
- C:\Windows\System\JMcOdGv.exe
  C:\Windows\System\JMcOdGv.exe
  2⤵
  PID:900
- C:\Windows\System\vdFkYZX.exe
  C:\Windows\System\vdFkYZX.exe
  2⤵
  PID:1628
- C:\Windows\System\FDNFGDo.exe
  C:\Windows\System\FDNFGDo.exe
  2⤵
  PID:2608
- C:\Windows\System\dbnjexD.exe
  C:\Windows\System\dbnjexD.exe
  2⤵
  PID:2844
- C:\Windows\System\bSWxdzz.exe
  C:\Windows\System\bSWxdzz.exe
  2⤵
  PID:2412
- C:\Windows\System\PRzGhZq.exe
  C:\Windows\System\PRzGhZq.exe
  2⤵
  PID:2404
- C:\Windows\System\wQZVLXn.exe
  C:\Windows\System\wQZVLXn.exe
  2⤵
  PID:1904
- C:\Windows\System\uqaoNMa.exe
  C:\Windows\System\uqaoNMa.exe
  2⤵
  PID:1720
- C:\Windows\System\smsYnJO.exe
  C:\Windows\System\smsYnJO.exe
  2⤵
  PID:2128
- C:\Windows\System\GDhWryN.exe
  C:\Windows\System\GDhWryN.exe
  2⤵
  PID:1692
- C:\Windows\System\PAmeqZl.exe
  C:\Windows\System\PAmeqZl.exe
  2⤵
  PID:1892
- C:\Windows\System\vyQcsYy.exe
  C:\Windows\System\vyQcsYy.exe
  2⤵
  PID:2132
- C:\Windows\System\TLdkEaV.exe
  C:\Windows\System\TLdkEaV.exe
  2⤵
  PID:1604
- C:\Windows\System\lexeHWW.exe
  C:\Windows\System\lexeHWW.exe
  2⤵
  PID:2052
- C:\Windows\System\XaVDGEK.exe
  C:\Windows\System\XaVDGEK.exe
  2⤵
  PID:1736
- C:\Windows\System\qvBLvpk.exe
  C:\Windows\System\qvBLvpk.exe
  2⤵
  PID:764
- C:\Windows\System\TjvkXRr.exe
  C:\Windows\System\TjvkXRr.exe
  2⤵
  PID:1520
- C:\Windows\System\VbuDqYW.exe
  C:\Windows\System\VbuDqYW.exe
  2⤵
  PID:2548
- C:\Windows\System\parpiDu.exe
  C:\Windows\System\parpiDu.exe
  2⤵
  PID:2392
- C:\Windows\System\mCqhtxK.exe
  C:\Windows\System\mCqhtxK.exe
  2⤵
  PID:2660
- C:\Windows\System\MxPvzUB.exe
  C:\Windows\System\MxPvzUB.exe
  2⤵
  PID:1260
- C:\Windows\System\QEuPwHp.exe
  C:\Windows\System\QEuPwHp.exe
  2⤵
  PID:2268
- C:\Windows\System\WoUrYow.exe
  C:\Windows\System\WoUrYow.exe
  2⤵
  PID:2008
- C:\Windows\System\nprFQVr.exe
  C:\Windows\System\nprFQVr.exe
  2⤵
  PID:2996
- C:\Windows\System\BwqOSkT.exe
  C:\Windows\System\BwqOSkT.exe
  2⤵
  PID:1616
- C:\Windows\System\lrHkJPY.exe
  C:\Windows\System\lrHkJPY.exe
  2⤵
  PID:3008
- C:\Windows\System\EIDaguE.exe
  C:\Windows\System\EIDaguE.exe
  2⤵
  PID:2524
- C:\Windows\System\qcnPFlX.exe
  C:\Windows\System\qcnPFlX.exe
  2⤵
  PID:2424
- C:\Windows\System\qKjTRmt.exe
  C:\Windows\System\qKjTRmt.exe
  2⤵
  PID:108
- C:\Windows\System\RFxIqji.exe
  C:\Windows\System\RFxIqji.exe
  2⤵
  PID:352
- C:\Windows\System\YZsAWzh.exe
  C:\Windows\System\YZsAWzh.exe
  2⤵
  PID:2448
- C:\Windows\System\pNloJXi.exe
  C:\Windows\System\pNloJXi.exe
  2⤵
  PID:2004
- C:\Windows\System\LDuNwNv.exe
  C:\Windows\System\LDuNwNv.exe
  2⤵
  PID:2596
- C:\Windows\System\EtKqykd.exe
  C:\Windows\System\EtKqykd.exe
  2⤵
  PID:3096
- C:\Windows\System\oxiBPSM.exe
  C:\Windows\System\oxiBPSM.exe
  2⤵
  PID:3116
- C:\Windows\System\AyvIcxr.exe
  C:\Windows\System\AyvIcxr.exe
  2⤵
  PID:3132
- C:\Windows\System\HuHcGxc.exe
  C:\Windows\System\HuHcGxc.exe
  2⤵
  PID:3148
- C:\Windows\System\wHPvvFI.exe
  C:\Windows\System\wHPvvFI.exe
  2⤵
  PID:3164
- C:\Windows\System\jqGqKMP.exe
  C:\Windows\System\jqGqKMP.exe
  2⤵
  PID:3180
- C:\Windows\System\zIROkAG.exe
  C:\Windows\System\zIROkAG.exe
  2⤵
  PID:3196
- C:\Windows\System\LwWiYGt.exe
  C:\Windows\System\LwWiYGt.exe
  2⤵
  PID:3212
- C:\Windows\System\zgYDhkH.exe
  C:\Windows\System\zgYDhkH.exe
  2⤵
  PID:3228
- C:\Windows\System\XHSssEb.exe
  C:\Windows\System\XHSssEb.exe
  2⤵
  PID:3244
- C:\Windows\System\PlKsWrh.exe
  C:\Windows\System\PlKsWrh.exe
  2⤵
  PID:3268
- C:\Windows\System\XqvHjVQ.exe
  C:\Windows\System\XqvHjVQ.exe
  2⤵
  PID:3284
- C:\Windows\System\ccSKEKh.exe
  C:\Windows\System\ccSKEKh.exe
  2⤵
  PID:3300
- C:\Windows\System\gPSJXuQ.exe
  C:\Windows\System\gPSJXuQ.exe
  2⤵
  PID:3316
- C:\Windows\System\CDRgIYE.exe
  C:\Windows\System\CDRgIYE.exe
  2⤵
  PID:3332
- C:\Windows\System\ckSGurT.exe
  C:\Windows\System\ckSGurT.exe
  2⤵
  PID:3348
- C:\Windows\System\RCsJkih.exe
  C:\Windows\System\RCsJkih.exe
  2⤵
  PID:3364
- C:\Windows\System\SWSmzHI.exe
  C:\Windows\System\SWSmzHI.exe
  2⤵
  PID:3384
- C:\Windows\System\aiZKVTA.exe
  C:\Windows\System\aiZKVTA.exe
  2⤵
  PID:3400
- C:\Windows\System\UarANay.exe
  C:\Windows\System\UarANay.exe
  2⤵
  PID:3416
- C:\Windows\System\NYVOqcW.exe
  C:\Windows\System\NYVOqcW.exe
  2⤵
  PID:3432
- C:\Windows\System\FdAQIhu.exe
  C:\Windows\System\FdAQIhu.exe
  2⤵
  PID:3452
- C:\Windows\System\khfGRPn.exe
  C:\Windows\System\khfGRPn.exe
  2⤵
  PID:3468
- C:\Windows\System\aBFQeAh.exe
  C:\Windows\System\aBFQeAh.exe
  2⤵
  PID:3484
- C:\Windows\System\jWsMtzo.exe
  C:\Windows\System\jWsMtzo.exe
  2⤵
  PID:3500
- C:\Windows\System\UgqZSPo.exe
  C:\Windows\System\UgqZSPo.exe
  2⤵
  PID:3516
- C:\Windows\System\TLpdlxV.exe
  C:\Windows\System\TLpdlxV.exe
  2⤵
  PID:3532
- C:\Windows\System\annYtEB.exe
  C:\Windows\System\annYtEB.exe
  2⤵
  PID:3548
- C:\Windows\System\MaRSrGv.exe
  C:\Windows\System\MaRSrGv.exe
  2⤵
  PID:3564
- C:\Windows\System\ojzQgPg.exe
  C:\Windows\System\ojzQgPg.exe
  2⤵
  PID:3580
- C:\Windows\System\gsoVyBg.exe
  C:\Windows\System\gsoVyBg.exe
  2⤵
  PID:3596
- C:\Windows\System\MHnUhqh.exe
  C:\Windows\System\MHnUhqh.exe
  2⤵
  PID:3612
- C:\Windows\System\iRRPfDL.exe
  C:\Windows\System\iRRPfDL.exe
  2⤵
  PID:3628
- C:\Windows\System\mCLXigd.exe
  C:\Windows\System\mCLXigd.exe
  2⤵
  PID:3644
- C:\Windows\System\KJvaqrg.exe
  C:\Windows\System\KJvaqrg.exe
  2⤵
  PID:3660
- C:\Windows\System\QoAebcx.exe
  C:\Windows\System\QoAebcx.exe
  2⤵
  PID:3676
- C:\Windows\System\UnxqUcI.exe
  C:\Windows\System\UnxqUcI.exe
  2⤵
  PID:3692
- C:\Windows\System\ydTXzLd.exe
  C:\Windows\System\ydTXzLd.exe
  2⤵
  PID:3708
- C:\Windows\System\GHqyoOr.exe
  C:\Windows\System\GHqyoOr.exe
  2⤵
  PID:3724
- C:\Windows\System\rdWShCD.exe
  C:\Windows\System\rdWShCD.exe
  2⤵
  PID:3744
- C:\Windows\System\QHnVZob.exe
  C:\Windows\System\QHnVZob.exe
  2⤵
  PID:3760
- C:\Windows\System\RPkKxeF.exe
  C:\Windows\System\RPkKxeF.exe
  2⤵
  PID:3776
- C:\Windows\System\ZGUpSwC.exe
  C:\Windows\System\ZGUpSwC.exe
  2⤵
  PID:3792
- C:\Windows\System\AiEvDvI.exe
  C:\Windows\System\AiEvDvI.exe
  2⤵
  PID:3808
- C:\Windows\System\sDkqBLz.exe
  C:\Windows\System\sDkqBLz.exe
  2⤵
  PID:3824
- C:\Windows\System\PwSOaVe.exe
  C:\Windows\System\PwSOaVe.exe
  2⤵
  PID:3840
- C:\Windows\System\pqDACyW.exe
  C:\Windows\System\pqDACyW.exe
  2⤵
  PID:3856
- C:\Windows\System\XJekatw.exe
  C:\Windows\System\XJekatw.exe
  2⤵
  PID:3892
- C:\Windows\System\RafAwZS.exe
  C:\Windows\System\RafAwZS.exe
  2⤵
  PID:3920
- C:\Windows\System\PHXYfSo.exe
  C:\Windows\System\PHXYfSo.exe
  2⤵
  PID:3936
- C:\Windows\System\nxWQPUN.exe
  C:\Windows\System\nxWQPUN.exe
  2⤵
  PID:3952
- C:\Windows\System\rlvAJnY.exe
  C:\Windows\System\rlvAJnY.exe
  2⤵
  PID:3968
- C:\Windows\System\PvZTmiO.exe
  C:\Windows\System\PvZTmiO.exe
  2⤵
  PID:3984
- C:\Windows\System\amdNRKP.exe
  C:\Windows\System\amdNRKP.exe
  2⤵
  PID:4000
- C:\Windows\System\KZXFESm.exe
  C:\Windows\System\KZXFESm.exe
  2⤵
  PID:4016
- C:\Windows\System\OuCWkRl.exe
  C:\Windows\System\OuCWkRl.exe
  2⤵
  PID:4032
- C:\Windows\System\rZpUyzF.exe
  C:\Windows\System\rZpUyzF.exe
  2⤵
  PID:4048
- C:\Windows\System\PZivaZk.exe
  C:\Windows\System\PZivaZk.exe
  2⤵
  PID:4064
- C:\Windows\System\ZCglyMz.exe
  C:\Windows\System\ZCglyMz.exe
  2⤵
  PID:4080
- C:\Windows\System\WLCMljO.exe
  C:\Windows\System\WLCMljO.exe
  2⤵
  PID:1704
- C:\Windows\System\pqEuGNq.exe
  C:\Windows\System\pqEuGNq.exe
  2⤵
  PID:1908
- C:\Windows\System\VTqNOJl.exe
  C:\Windows\System\VTqNOJl.exe
  2⤵
  PID:1600
- C:\Windows\System\hwXxupu.exe
  C:\Windows\System\hwXxupu.exe
  2⤵
  PID:1944
- C:\Windows\System\JhcUltq.exe
  C:\Windows\System\JhcUltq.exe
  2⤵
  PID:340
- C:\Windows\System\KlBmlBy.exe
  C:\Windows\System\KlBmlBy.exe
  2⤵
  PID:3092
- C:\Windows\System\PdPoCWp.exe
  C:\Windows\System\PdPoCWp.exe
  2⤵
  PID:3140
- C:\Windows\System\XMpfixO.exe
  C:\Windows\System\XMpfixO.exe
  2⤵
  PID:3176
- C:\Windows\System\ayvUnsm.exe
  C:\Windows\System\ayvUnsm.exe
  2⤵
  PID:3444
- C:\Windows\System\yBSxmEY.exe
  C:\Windows\System\yBSxmEY.exe
  2⤵
  PID:3236
- C:\Windows\System\EisVLce.exe
  C:\Windows\System\EisVLce.exe
  2⤵
  PID:3128
- C:\Windows\System\AdZOkzs.exe
  C:\Windows\System\AdZOkzs.exe
  2⤵
  PID:3340
- C:\Windows\System\cAfTUEB.exe
  C:\Windows\System\cAfTUEB.exe
  2⤵
  PID:3376
- C:\Windows\System\GFIJtIH.exe
  C:\Windows\System\GFIJtIH.exe
  2⤵
  PID:3408
- C:\Windows\System\JaYuvOw.exe
  C:\Windows\System\JaYuvOw.exe
  2⤵
  PID:3476
- C:\Windows\System\komikTG.exe
  C:\Windows\System\komikTG.exe
  2⤵
  PID:3508
- C:\Windows\System\wETAXEJ.exe
  C:\Windows\System\wETAXEJ.exe
  2⤵
  PID:3604
- C:\Windows\System\WaDiFSF.exe
  C:\Windows\System\WaDiFSF.exe
  2⤵
  PID:3672
- C:\Windows\System\QGluFNS.exe
  C:\Windows\System\QGluFNS.exe
  2⤵
  PID:3736
- C:\Windows\System\bpVuqMZ.exe
  C:\Windows\System\bpVuqMZ.exe
  2⤵
  PID:3804
- C:\Windows\System\XNcUqWR.exe
  C:\Windows\System\XNcUqWR.exe
  2⤵
  PID:3872
- C:\Windows\System\UbZDKSF.exe
  C:\Windows\System\UbZDKSF.exe
  2⤵
  PID:3888
- C:\Windows\System\OhCezZB.exe
  C:\Windows\System\OhCezZB.exe
  2⤵
  PID:1836
- C:\Windows\System\EezVhQB.exe
  C:\Windows\System\EezVhQB.exe
  2⤵
  PID:4100
- C:\Windows\System\eTKfrsk.exe
  C:\Windows\System\eTKfrsk.exe
  2⤵
  PID:4116
- C:\Windows\System\QHaTZlt.exe
  C:\Windows\System\QHaTZlt.exe
  2⤵
  PID:4316
- C:\Windows\System\keFcyGt.exe
  C:\Windows\System\keFcyGt.exe
  2⤵
  PID:4340
- C:\Windows\System\QBnYOen.exe
  C:\Windows\System\QBnYOen.exe
  2⤵
  PID:4376
- C:\Windows\System\UwjUKjp.exe
  C:\Windows\System\UwjUKjp.exe
  2⤵
  PID:4392
- C:\Windows\System\tFkfgcH.exe
  C:\Windows\System\tFkfgcH.exe
  2⤵
  PID:4408
- C:\Windows\System\fYKrFXy.exe
  C:\Windows\System\fYKrFXy.exe
  2⤵
  PID:4424
- C:\Windows\System\RQpRqQF.exe
  C:\Windows\System\RQpRqQF.exe
  2⤵
  PID:4444
- C:\Windows\System\qgiHvmT.exe
  C:\Windows\System\qgiHvmT.exe
  2⤵
  PID:4468
- C:\Windows\System\NMqxbHf.exe
  C:\Windows\System\NMqxbHf.exe
  2⤵
  PID:4484
- C:\Windows\System\OBTEOpG.exe
  C:\Windows\System\OBTEOpG.exe
  2⤵
  PID:4524
- C:\Windows\System\qVcquhc.exe
  C:\Windows\System\qVcquhc.exe
  2⤵
  PID:4540
- C:\Windows\System\mEItuWQ.exe
  C:\Windows\System\mEItuWQ.exe
  2⤵
  PID:4560
- C:\Windows\System\orgRGIt.exe
  C:\Windows\System\orgRGIt.exe
  2⤵
  PID:4576
- C:\Windows\System\rAmmIfe.exe
  C:\Windows\System\rAmmIfe.exe
  2⤵
  PID:4632
- C:\Windows\System\KQmDLkB.exe
  C:\Windows\System\KQmDLkB.exe
  2⤵
  PID:4652
- C:\Windows\System\ddfTHqu.exe
  C:\Windows\System\ddfTHqu.exe
  2⤵
  PID:4668
- C:\Windows\System\CAplZjN.exe
  C:\Windows\System\CAplZjN.exe
  2⤵
  PID:4684
- C:\Windows\System\hFJkIvw.exe
  C:\Windows\System\hFJkIvw.exe
  2⤵
  PID:4700
- C:\Windows\System\XcPYkmH.exe
  C:\Windows\System\XcPYkmH.exe
  2⤵
  PID:4716
- C:\Windows\System\ZeonSSS.exe
  C:\Windows\System\ZeonSSS.exe
  2⤵
  PID:4732
- C:\Windows\System\kyNfsev.exe
  C:\Windows\System\kyNfsev.exe
  2⤵
  PID:4748
- C:\Windows\System\EiTXGtQ.exe
  C:\Windows\System\EiTXGtQ.exe
  2⤵
  PID:4764
- C:\Windows\System\urgQoTL.exe
  C:\Windows\System\urgQoTL.exe
  2⤵
  PID:4780
- C:\Windows\System\ZcNiHCX.exe
  C:\Windows\System\ZcNiHCX.exe
  2⤵
  PID:4796
- C:\Windows\System\wPzORSf.exe
  C:\Windows\System\wPzORSf.exe
  2⤵
  PID:4812
- C:\Windows\System\twWjOuj.exe
  C:\Windows\System\twWjOuj.exe
  2⤵
  PID:4836
- C:\Windows\System\JaWnEBT.exe
  C:\Windows\System\JaWnEBT.exe
  2⤵
  PID:4852
- C:\Windows\System\VwUKaMv.exe
  C:\Windows\System\VwUKaMv.exe
  2⤵
  PID:4868
- C:\Windows\System\HGyrqRv.exe
  C:\Windows\System\HGyrqRv.exe
  2⤵
  PID:4884
- C:\Windows\System\SYBUiLC.exe
  C:\Windows\System\SYBUiLC.exe
  2⤵
  PID:4900
- C:\Windows\System\KCAKiDI.exe
  C:\Windows\System\KCAKiDI.exe
  2⤵
  PID:4916
- C:\Windows\System\bIQzOsW.exe
  C:\Windows\System\bIQzOsW.exe
  2⤵
  PID:4932
- C:\Windows\System\JuSjHEH.exe
  C:\Windows\System\JuSjHEH.exe
  2⤵
  PID:4952
- C:\Windows\System\weayGHs.exe
  C:\Windows\System\weayGHs.exe
  2⤵
  PID:4968
- C:\Windows\System\dtDGLas.exe
  C:\Windows\System\dtDGLas.exe
  2⤵
  PID:4984
- C:\Windows\System\pHypRdw.exe
  C:\Windows\System\pHypRdw.exe
  2⤵
  PID:5000
- C:\Windows\System\uBWuTbf.exe
  C:\Windows\System\uBWuTbf.exe
  2⤵
  PID:5016
- C:\Windows\System\XwCsaFG.exe
  C:\Windows\System\XwCsaFG.exe
  2⤵
  PID:5032
- C:\Windows\System\OGBzznf.exe
  C:\Windows\System\OGBzznf.exe
  2⤵
  PID:5048
- C:\Windows\System\uZOiHFv.exe
  C:\Windows\System\uZOiHFv.exe
  2⤵
  PID:5068
- C:\Windows\System\wyweRIx.exe
  C:\Windows\System\wyweRIx.exe
  2⤵
  PID:5084
- C:\Windows\System\AaQNaZu.exe
  C:\Windows\System\AaQNaZu.exe
  2⤵
  PID:5100
- C:\Windows\System\knWPSca.exe
  C:\Windows\System\knWPSca.exe
  2⤵
  PID:5116
- C:\Windows\System\ykpTJxZ.exe
  C:\Windows\System\ykpTJxZ.exe
  2⤵
  PID:2624
- C:\Windows\System\bRsGgCM.exe
  C:\Windows\System\bRsGgCM.exe
  2⤵
  PID:848
- C:\Windows\System\CWNPIrc.exe
  C:\Windows\System\CWNPIrc.exe
  2⤵
  PID:2364
- C:\Windows\System\oANLpbS.exe
  C:\Windows\System\oANLpbS.exe
  2⤵
  PID:2064
- C:\Windows\System\tpUCmZH.exe
  C:\Windows\System\tpUCmZH.exe
  2⤵
  PID:1564
- C:\Windows\System\cGCjMNW.exe
  C:\Windows\System\cGCjMNW.exe
  2⤵
  PID:2536
- C:\Windows\System\KtdwPcR.exe
  C:\Windows\System\KtdwPcR.exe
  2⤵
  PID:2644
- C:\Windows\System\wCXbWgC.exe
  C:\Windows\System\wCXbWgC.exe
  2⤵
  PID:2888
- C:\Windows\System\mCuPwmC.exe
  C:\Windows\System\mCuPwmC.exe
  2⤵
  PID:760
- C:\Windows\System\vAbiOPa.exe
  C:\Windows\System\vAbiOPa.exe
  2⤵
  PID:356
- C:\Windows\System\AEQalqd.exe
  C:\Windows\System\AEQalqd.exe
  2⤵
  PID:3252
- C:\Windows\System\PIiXKKH.exe
  C:\Windows\System\PIiXKKH.exe
  2⤵
  PID:3296
- C:\Windows\System\lScWFDV.exe
  C:\Windows\System\lScWFDV.exe
  2⤵
  PID:3424
- C:\Windows\System\bstzYoN.exe
  C:\Windows\System\bstzYoN.exe
  2⤵
  PID:3524
- C:\Windows\System\fOSzwIp.exe
  C:\Windows\System\fOSzwIp.exe
  2⤵
  PID:2320
- C:\Windows\System\FOeRLFu.exe
  C:\Windows\System\FOeRLFu.exe
  2⤵
  PID:3928
- C:\Windows\System\hLOoddd.exe
  C:\Windows\System\hLOoddd.exe
  2⤵
  PID:3992
- C:\Windows\System\uWUAYZv.exe
  C:\Windows\System\uWUAYZv.exe
  2⤵
  PID:3756
- C:\Windows\System\rwyDtZW.exe
  C:\Windows\System\rwyDtZW.exe
  2⤵
  PID:3820
- C:\Windows\System\loXSSlL.exe
  C:\Windows\System\loXSSlL.exe
  2⤵
  PID:4088
- C:\Windows\System\DlelyDe.exe
  C:\Windows\System\DlelyDe.exe
  2⤵
  PID:1420
- C:\Windows\System\TVLqzjD.exe
  C:\Windows\System\TVLqzjD.exe
  2⤵
  PID:3848
- C:\Windows\System\ZVBWzHu.exe
  C:\Windows\System\ZVBWzHu.exe
  2⤵
  PID:2716
- C:\Windows\System\vFsjSyT.exe
  C:\Windows\System\vFsjSyT.exe
  2⤵
  PID:3000
- C:\Windows\System\tVMbahz.exe
  C:\Windows\System\tVMbahz.exe
  2⤵
  PID:1912
- C:\Windows\System\yNPNXqL.exe
  C:\Windows\System\yNPNXqL.exe
  2⤵
  PID:3372
- C:\Windows\System\qMzrWge.exe
  C:\Windows\System\qMzrWge.exe
  2⤵
  PID:3440
- C:\Windows\System\oTFrsWa.exe
  C:\Windows\System\oTFrsWa.exe
  2⤵
  PID:3836
- C:\Windows\System\yxGLyhN.exe
  C:\Windows\System\yxGLyhN.exe
  2⤵
  PID:2900
- C:\Windows\System\SiQJMxZ.exe
  C:\Windows\System\SiQJMxZ.exe
  2⤵
  PID:4328
- C:\Windows\System\zxGgxwO.exe
  C:\Windows\System\zxGgxwO.exe
  2⤵
  PID:4008
- C:\Windows\System\EGOkJnH.exe
  C:\Windows\System\EGOkJnH.exe
  2⤵
  PID:4464
- C:\Windows\System\yKJdeyR.exe
  C:\Windows\System\yKJdeyR.exe
  2⤵
  PID:4420
- C:\Windows\System\bjKpmwP.exe
  C:\Windows\System\bjKpmwP.exe
  2⤵
  PID:4456
- C:\Windows\System\YTDahfd.exe
  C:\Windows\System\YTDahfd.exe
  2⤵
  PID:992
- C:\Windows\System\IhYXrIP.exe
  C:\Windows\System\IhYXrIP.exe
  2⤵
  PID:4512
- C:\Windows\System\ymHhNmb.exe
  C:\Windows\System\ymHhNmb.exe
  2⤵
  PID:4552
- C:\Windows\System\YuKKoxx.exe
  C:\Windows\System\YuKKoxx.exe
  2⤵
  PID:4596
- C:\Windows\System\bOZcUjs.exe
  C:\Windows\System\bOZcUjs.exe
  2⤵
  PID:4612
- C:\Windows\System\jdSAjYm.exe
  C:\Windows\System\jdSAjYm.exe
  2⤵
  PID:3192
- C:\Windows\System\UsMGAGu.exe
  C:\Windows\System\UsMGAGu.exe
  2⤵
  PID:1348
- C:\Windows\System\amazUXX.exe
  C:\Windows\System\amazUXX.exe
  2⤵
  PID:4728
- C:\Windows\System\mFfJVNS.exe
  C:\Windows\System\mFfJVNS.exe
  2⤵
  PID:3224
- C:\Windows\System\onvLCvm.exe
  C:\Windows\System\onvLCvm.exe
  2⤵
  PID:3324
- C:\Windows\System\GqKqiTQ.exe
  C:\Windows\System\GqKqiTQ.exe
  2⤵
  PID:3396
- C:\Windows\System\XnYXDPm.exe
  C:\Windows\System\XnYXDPm.exe
  2⤵
  PID:4168
- C:\Windows\System\VlBDuKZ.exe
  C:\Windows\System\VlBDuKZ.exe
  2⤵
  PID:4188
- C:\Windows\System\lsCWvBr.exe
  C:\Windows\System\lsCWvBr.exe
  2⤵
  PID:4204
- C:\Windows\System\KNiYViH.exe
  C:\Windows\System\KNiYViH.exe
  2⤵
  PID:4220
- C:\Windows\System\XQJGkcZ.exe
  C:\Windows\System\XQJGkcZ.exe
  2⤵
  PID:3528
- C:\Windows\System\uMopbBy.exe
  C:\Windows\System\uMopbBy.exe
  2⤵
  PID:4236
- C:\Windows\System\wEWnYuV.exe
  C:\Windows\System\wEWnYuV.exe
  2⤵
  PID:4248
- C:\Windows\System\mQOasyP.exe
  C:\Windows\System\mQOasyP.exe
  2⤵
  PID:4256
- C:\Windows\System\IQIIdzf.exe
  C:\Windows\System\IQIIdzf.exe
  2⤵
  PID:4276
- C:\Windows\System\gjBpAsJ.exe
  C:\Windows\System\gjBpAsJ.exe
  2⤵
  PID:4292
- C:\Windows\System\xNhTjHN.exe
  C:\Windows\System\xNhTjHN.exe
  2⤵
  PID:4308
- C:\Windows\System\WsszTpU.exe
  C:\Windows\System\WsszTpU.exe
  2⤵
  PID:3916
- C:\Windows\System\AWnHEml.exe
  C:\Windows\System\AWnHEml.exe
  2⤵
  PID:4360
- C:\Windows\System\KUbVBPc.exe
  C:\Windows\System\KUbVBPc.exe
  2⤵
  PID:4404
- C:\Windows\System\hsASERp.exe
  C:\Windows\System\hsASERp.exe
  2⤵
  PID:4480
- C:\Windows\System\jRzwYRi.exe
  C:\Windows\System\jRzwYRi.exe
  2⤵
  PID:5124
- C:\Windows\System\saACpRr.exe
  C:\Windows\System\saACpRr.exe
  2⤵
  PID:5140
- C:\Windows\System\aHlkSup.exe
  C:\Windows\System\aHlkSup.exe
  2⤵
  PID:5156
- C:\Windows\System\IOSlUEM.exe
  C:\Windows\System\IOSlUEM.exe
  2⤵
  PID:5176
- C:\Windows\System\NBpsGZm.exe
  C:\Windows\System\NBpsGZm.exe
  2⤵
  PID:5192
- C:\Windows\System\dIZDreP.exe
  C:\Windows\System\dIZDreP.exe
  2⤵
  PID:5208
- C:\Windows\System\BeAbnqI.exe
  C:\Windows\System\BeAbnqI.exe
  2⤵
  PID:5224
- C:\Windows\System\jKleHiX.exe
  C:\Windows\System\jKleHiX.exe
  2⤵
  PID:5252
- C:\Windows\System\BAXwbYe.exe
  C:\Windows\System\BAXwbYe.exe
  2⤵
  PID:5268
- C:\Windows\System\RLbSUjo.exe
  C:\Windows\System\RLbSUjo.exe
  2⤵
  PID:5284
- C:\Windows\System\fUNdgYu.exe
  C:\Windows\System\fUNdgYu.exe
  2⤵
  PID:5300
- C:\Windows\System\pCWtamv.exe
  C:\Windows\System\pCWtamv.exe
  2⤵
  PID:5316
- C:\Windows\System\LREaEUB.exe
  C:\Windows\System\LREaEUB.exe
  2⤵
  PID:5332
- C:\Windows\System\uZZmcyB.exe
  C:\Windows\System\uZZmcyB.exe
  2⤵
  PID:5348
- C:\Windows\System\mjcxtrI.exe
  C:\Windows\System\mjcxtrI.exe
  2⤵
  PID:5364
- C:\Windows\System\pSEzohG.exe
  C:\Windows\System\pSEzohG.exe
  2⤵
  PID:5384
- C:\Windows\System\uwfYpZI.exe
  C:\Windows\System\uwfYpZI.exe
  2⤵
  PID:5400
- C:\Windows\System\hqQEhnk.exe
  C:\Windows\System\hqQEhnk.exe
  2⤵
  PID:5416
- C:\Windows\System\EdXqKGu.exe
  C:\Windows\System\EdXqKGu.exe
  2⤵
  PID:5432
- C:\Windows\System\vOUtdEV.exe
  C:\Windows\System\vOUtdEV.exe
  2⤵
  PID:5448
- C:\Windows\System\YmnihQp.exe
  C:\Windows\System\YmnihQp.exe
  2⤵
  PID:5464
- C:\Windows\System\hzqcStN.exe
  C:\Windows\System\hzqcStN.exe
  2⤵
  PID:5480
- C:\Windows\System\hunwZyi.exe
  C:\Windows\System\hunwZyi.exe
  2⤵
  PID:5500
- C:\Windows\System\HLuWKNe.exe
  C:\Windows\System\HLuWKNe.exe
  2⤵
  PID:5516
- C:\Windows\System\YNidoIG.exe
  C:\Windows\System\YNidoIG.exe
  2⤵
  PID:5532
- C:\Windows\System\tnVROXh.exe
  C:\Windows\System\tnVROXh.exe
  2⤵
  PID:5548
- C:\Windows\System\oFIihkc.exe
  C:\Windows\System\oFIihkc.exe
  2⤵
  PID:5564
- C:\Windows\System\vwiXfgm.exe
  C:\Windows\System\vwiXfgm.exe
  2⤵
  PID:5580
- C:\Windows\System\nEoUSmK.exe
  C:\Windows\System\nEoUSmK.exe
  2⤵
  PID:5596
- C:\Windows\System\tQRlGvN.exe
  C:\Windows\System\tQRlGvN.exe
  2⤵
  PID:5616
- C:\Windows\System\iLhTyLt.exe
  C:\Windows\System\iLhTyLt.exe
  2⤵
  PID:5632
- C:\Windows\System\CnJwZgc.exe
  C:\Windows\System\CnJwZgc.exe
  2⤵
  PID:5648
- C:\Windows\System\DqwEYSa.exe
  C:\Windows\System\DqwEYSa.exe
  2⤵
  PID:5664
- C:\Windows\System\EEgBIYy.exe
  C:\Windows\System\EEgBIYy.exe
  2⤵
  PID:5684
- C:\Windows\System\CDpRPuL.exe
  C:\Windows\System\CDpRPuL.exe
  2⤵
  PID:5700
- C:\Windows\System\yvUuGvZ.exe
  C:\Windows\System\yvUuGvZ.exe
  2⤵
  PID:5780
- C:\Windows\System\ImVzrpG.exe
  C:\Windows\System\ImVzrpG.exe
  2⤵
  PID:5796
- C:\Windows\System\dsbktgH.exe
  C:\Windows\System\dsbktgH.exe
  2⤵
  PID:5852
- C:\Windows\System\BAtebII.exe
  C:\Windows\System\BAtebII.exe
  2⤵
  PID:5940
- C:\Windows\System\kPhiYJj.exe
  C:\Windows\System\kPhiYJj.exe
  2⤵
  PID:6140
- C:\Windows\System\szUQxfi.exe
  C:\Windows\System\szUQxfi.exe
  2⤵
  PID:5012
- C:\Windows\System\NzfzhAA.exe
  C:\Windows\System\NzfzhAA.exe
  2⤵
  PID:5096
- C:\Windows\System\acJChrG.exe
  C:\Windows\System\acJChrG.exe
  2⤵
  PID:4692
- C:\Windows\System\sFBrcbp.exe
  C:\Windows\System\sFBrcbp.exe
  2⤵
  PID:4760
- C:\Windows\System\OMYoSpr.exe
  C:\Windows\System\OMYoSpr.exe
  2⤵
  PID:4824
- C:\Windows\System\HrNXrUZ.exe
  C:\Windows\System\HrNXrUZ.exe
  2⤵
  PID:4864
- C:\Windows\System\grMXGfD.exe
  C:\Windows\System\grMXGfD.exe
  2⤵
  PID:4992
- C:\Windows\System\JPNDFCx.exe
  C:\Windows\System\JPNDFCx.exe
  2⤵
  PID:5064
- C:\Windows\System\owNrfBJ.exe
  C:\Windows\System\owNrfBJ.exe
  2⤵
  PID:1304
- C:\Windows\System\nmdBPhB.exe
  C:\Windows\System\nmdBPhB.exe
  2⤵
  PID:3220
- C:\Windows\System\XQwFbCQ.exe
  C:\Windows\System\XQwFbCQ.exe
  2⤵
  PID:3620
- C:\Windows\System\VTStNfW.exe
  C:\Windows\System\VTStNfW.exe
  2⤵
  PID:3816
- C:\Windows\System\kfCsBpb.exe
  C:\Windows\System\kfCsBpb.exe
  2⤵
  PID:2592
- C:\Windows\System\KXfufnA.exe
  C:\Windows\System\KXfufnA.exe
  2⤵
  PID:1544
- C:\Windows\System\tgUraFl.exe
  C:\Windows\System\tgUraFl.exe
  2⤵
  PID:4520
- C:\Windows\System\XQXWHkL.exe
  C:\Windows\System\XQXWHkL.exe
  2⤵
  PID:4588
- C:\Windows\System\qauKxyn.exe
  C:\Windows\System\qauKxyn.exe
  2⤵
  PID:4132
- C:\Windows\System\XKnNWHa.exe
  C:\Windows\System\XKnNWHa.exe
  2⤵
  PID:4216
- C:\Windows\System\iuMzWkk.exe
  C:\Windows\System\iuMzWkk.exe
  2⤵
  PID:4252
- C:\Windows\System\hQwVOaR.exe
  C:\Windows\System\hQwVOaR.exe
  2⤵
  PID:3912
- C:\Windows\System\uvmABoB.exe
  C:\Windows\System\uvmABoB.exe
  2⤵
  PID:5148
- C:\Windows\System\ohqvZNh.exe
  C:\Windows\System\ohqvZNh.exe
  2⤵
  PID:5216
- C:\Windows\System\pvebKvh.exe
  C:\Windows\System\pvebKvh.exe
  2⤵
  PID:5296
- C:\Windows\System\uXvlKbE.exe
  C:\Windows\System\uXvlKbE.exe
  2⤵
  PID:5264
- C:\Windows\System\XmFjmTw.exe
  C:\Windows\System\XmFjmTw.exe
  2⤵
  PID:5456
- C:\Windows\System\fNSWojs.exe
  C:\Windows\System\fNSWojs.exe
  2⤵
  PID:5488
- C:\Windows\System\eVhRjuU.exe
  C:\Windows\System\eVhRjuU.exe
  2⤵
  PID:5588
- C:\Windows\System\UFfYQeK.exe
  C:\Windows\System\UFfYQeK.exe
  2⤵
  PID:5692
- C:\Windows\System\SswTnwd.exe
  C:\Windows\System\SswTnwd.exe
  2⤵
  PID:2788
- C:\Windows\System\SXaIrGI.exe
  C:\Windows\System\SXaIrGI.exe
  2⤵
  PID:1444
- C:\Windows\System\gyJDNyK.exe
  C:\Windows\System\gyJDNyK.exe
  2⤵
  PID:796
- C:\Windows\System\sBgYikJ.exe
  C:\Windows\System\sBgYikJ.exe
  2⤵
  PID:5080
- C:\Windows\System\cTCXyMV.exe
  C:\Windows\System\cTCXyMV.exe
  2⤵
  PID:3076
- C:\Windows\System\fgWNzzI.exe
  C:\Windows\System\fgWNzzI.exe
  2⤵
  PID:3492
- C:\Windows\System\ZeRMYrY.exe
  C:\Windows\System\ZeRMYrY.exe
  2⤵
  PID:3752
- C:\Windows\System\CGyfcPb.exe
  C:\Windows\System\CGyfcPb.exe
  2⤵
  PID:3112
- C:\Windows\System\KNabANA.exe
  C:\Windows\System\KNabANA.exe
  2⤵
  PID:3732
- C:\Windows\System\QDjlRZh.exe
  C:\Windows\System\QDjlRZh.exe
  2⤵
  PID:4500
- C:\Windows\System\JVKawKj.exe
  C:\Windows\System\JVKawKj.exe
  2⤵
  PID:4620
- C:\Windows\System\IOdFPIK.exe
  C:\Windows\System\IOdFPIK.exe
  2⤵
  PID:4140
- C:\Windows\System\vlOfDce.exe
  C:\Windows\System\vlOfDce.exe
  2⤵
  PID:4164
- C:\Windows\System\KoMVYgR.exe
  C:\Windows\System\KoMVYgR.exe
  2⤵
  PID:4228
- C:\Windows\System\okDshAQ.exe
  C:\Windows\System\okDshAQ.exe
  2⤵
  PID:4264
- C:\Windows\System\ZzkkaVk.exe
  C:\Windows\System\ZzkkaVk.exe
  2⤵
  PID:4352
- C:\Windows\System\lLzAhSy.exe
  C:\Windows\System\lLzAhSy.exe
  2⤵
  PID:5136
- C:\Windows\System\SBwmlYh.exe
  C:\Windows\System\SBwmlYh.exe
  2⤵
  PID:5200
- C:\Windows\System\uTmyvBl.exe
  C:\Windows\System\uTmyvBl.exe
  2⤵
  PID:5240
- C:\Windows\System\sTdcnZf.exe
  C:\Windows\System\sTdcnZf.exe
  2⤵
  PID:5308
- C:\Windows\System\aSwRHPK.exe
  C:\Windows\System\aSwRHPK.exe
  2⤵
  PID:5376
- C:\Windows\System\slxQwcJ.exe
  C:\Windows\System\slxQwcJ.exe
  2⤵
  PID:5440
- C:\Windows\System\qzySzkP.exe
  C:\Windows\System\qzySzkP.exe
  2⤵
  PID:5508
- C:\Windows\System\DrOnboH.exe
  C:\Windows\System\DrOnboH.exe
  2⤵
  PID:5728
- C:\Windows\System\DIzwSvF.exe
  C:\Windows\System\DIzwSvF.exe
  2⤵
  PID:5748
- C:\Windows\System\hrWcVvH.exe
  C:\Windows\System\hrWcVvH.exe
  2⤵
  PID:5768
- C:\Windows\System\heQzMfY.exe
  C:\Windows\System\heQzMfY.exe
  2⤵
  PID:1388
- C:\Windows\System\HCjAniT.exe
  C:\Windows\System\HCjAniT.exe
  2⤵
  PID:1708
- C:\Windows\System\TGXBXht.exe
  C:\Windows\System\TGXBXht.exe
  2⤵
  PID:1612
- C:\Windows\System\uFwOyaP.exe
  C:\Windows\System\uFwOyaP.exe
  2⤵
  PID:5872
- C:\Windows\System\ueXimMR.exe
  C:\Windows\System\ueXimMR.exe
  2⤵
  PID:5892
- C:\Windows\System\wLcmiQT.exe
  C:\Windows\System\wLcmiQT.exe
  2⤵
  PID:5908
- C:\Windows\System\kTAsswN.exe
  C:\Windows\System\kTAsswN.exe
  2⤵
  PID:5924
- C:\Windows\System\NrDmJEM.exe
  C:\Windows\System\NrDmJEM.exe
  2⤵
  PID:5964
- C:\Windows\System\WGMrsTF.exe
  C:\Windows\System\WGMrsTF.exe
  2⤵
  PID:5972
- C:\Windows\System\WXSrJFs.exe
  C:\Windows\System\WXSrJFs.exe
  2⤵
  PID:5984
- C:\Windows\System\icuLrKN.exe
  C:\Windows\System\icuLrKN.exe
  2⤵
  PID:5992
- C:\Windows\System\zfyhAdS.exe
  C:\Windows\System\zfyhAdS.exe
  2⤵
  PID:6008
- C:\Windows\System\IEsbOOM.exe
  C:\Windows\System\IEsbOOM.exe
  2⤵
  PID:6020
- C:\Windows\System\ZhmYgke.exe
  C:\Windows\System\ZhmYgke.exe
  2⤵
  PID:6040
- C:\Windows\System\qRXAMwd.exe
  C:\Windows\System\qRXAMwd.exe
  2⤵
  PID:6056
- C:\Windows\System\NCcYOtU.exe
  C:\Windows\System\NCcYOtU.exe
  2⤵
  PID:6072
- C:\Windows\System\jhqKlfA.exe
  C:\Windows\System\jhqKlfA.exe
  2⤵
  PID:2100
- C:\Windows\System\neOOjZi.exe
  C:\Windows\System\neOOjZi.exe
  2⤵
  PID:6100
- C:\Windows\System\hBRVTBU.exe
  C:\Windows\System\hBRVTBU.exe
  2⤵
  PID:6112
- C:\Windows\System\jmcXhca.exe
  C:\Windows\System\jmcXhca.exe
  2⤵
  PID:6080
- C:\Windows\System\TdpSres.exe
  C:\Windows\System\TdpSres.exe
  2⤵
  PID:6128
- C:\Windows\System\BlBeIeI.exe
  C:\Windows\System\BlBeIeI.exe
  2⤵
  PID:1500
- C:\Windows\System\YzSOxqN.exe
  C:\Windows\System\YzSOxqN.exe
  2⤵
  PID:2360
- C:\Windows\System\WtQmpKg.exe
  C:\Windows\System\WtQmpKg.exe
  2⤵
  PID:768
- C:\Windows\System\MHFhInQ.exe
  C:\Windows\System\MHFhInQ.exe
  2⤵
  PID:2720
- C:\Windows\System\RFYYCSe.exe
  C:\Windows\System\RFYYCSe.exe
  2⤵
  PID:2532
- C:\Windows\System\NZimvzj.exe
  C:\Windows\System\NZimvzj.exe
  2⤵
  PID:3668
- C:\Windows\System\qLffFRk.exe
  C:\Windows\System\qLffFRk.exe
  2⤵
  PID:4648
- C:\Windows\System\SDpPMsz.exe
  C:\Windows\System\SDpPMsz.exe
  2⤵
  PID:3880
- C:\Windows\System\VPccaqI.exe
  C:\Windows\System\VPccaqI.exe
  2⤵
  PID:4680
- C:\Windows\System\fUrHkXz.exe
  C:\Windows\System\fUrHkXz.exe
  2⤵
  PID:2416
- C:\Windows\System\maNhKfv.exe
  C:\Windows\System\maNhKfv.exe
  2⤵
  PID:4708
- C:\Windows\System\pNJKEcF.exe
  C:\Windows\System\pNJKEcF.exe
  2⤵
  PID:4772
- C:\Windows\System\BwRxoRf.exe
  C:\Windows\System\BwRxoRf.exe
  2⤵
  PID:1392
- C:\Windows\System\HWBvnbW.exe
  C:\Windows\System\HWBvnbW.exe
  2⤵
  PID:1840
- C:\Windows\System\bQqrdzs.exe
  C:\Windows\System\bQqrdzs.exe
  2⤵
  PID:1548
- C:\Windows\System\HRRIrJJ.exe
  C:\Windows\System\HRRIrJJ.exe
  2⤵
  PID:4908
- C:\Windows\System\xbCDamr.exe
  C:\Windows\System\xbCDamr.exe
  2⤵
  PID:4948
- C:\Windows\System\toHhYro.exe
  C:\Windows\System\toHhYro.exe
  2⤵
  PID:2692
- C:\Windows\System\BRaLSKZ.exe
  C:\Windows\System\BRaLSKZ.exe
  2⤵
  PID:964
- C:\Windows\System\rFuZhsP.exe
  C:\Windows\System\rFuZhsP.exe
  2⤵
  PID:4660
- C:\Windows\System\jKKhFug.exe
  C:\Windows\System\jKKhFug.exe
  2⤵
  PID:4792
- C:\Windows\System\QBzCXWb.exe
  C:\Windows\System\QBzCXWb.exe
  2⤵
  PID:4892
- C:\Windows\System\xophnxY.exe
  C:\Windows\System\xophnxY.exe
  2⤵
  PID:4928
- C:\Windows\System\yJniliL.exe
  C:\Windows\System\yJniliL.exe
  2⤵
  PID:5060
- C:\Windows\System\jKsakUG.exe
  C:\Windows\System\jKsakUG.exe
  2⤵
  PID:4348
- C:\Windows\System\zkqHYCt.exe
  C:\Windows\System\zkqHYCt.exe
  2⤵
  PID:2076
- C:\Windows\System\Pfnayna.exe
  C:\Windows\System\Pfnayna.exe
  2⤵
  PID:3964
- C:\Windows\System\jiZDAHV.exe
  C:\Windows\System\jiZDAHV.exe
  2⤵
  PID:2528
- C:\Windows\System\yHOZWrP.exe
  C:\Windows\System\yHOZWrP.exe
  2⤵
  PID:3448
- C:\Windows\System\xmTfHZv.exe
  C:\Windows\System\xmTfHZv.exe
  2⤵
  PID:4604
- C:\Windows\System\oFGgKqO.exe
  C:\Windows\System\oFGgKqO.exe
  2⤵
  PID:4184
- C:\Windows\System\NGCMTVO.exe
  C:\Windows\System\NGCMTVO.exe
  2⤵
  PID:4180
- C:\Windows\System\jnkVwjm.exe
  C:\Windows\System\jnkVwjm.exe
  2⤵
  PID:5188
- C:\Windows\System\liqrpfp.exe
  C:\Windows\System\liqrpfp.exe
  2⤵
  PID:4532
- C:\Windows\System\qREGAuC.exe
  C:\Windows\System\qREGAuC.exe
  2⤵
  PID:5424
- C:\Windows\System\vhCkref.exe
  C:\Windows\System\vhCkref.exe
  2⤵
  PID:5460
- C:\Windows\System\flHCEtw.exe
  C:\Windows\System\flHCEtw.exe
  2⤵
  PID:5360
- C:\Windows\System\MmHtFXF.exe
  C:\Windows\System\MmHtFXF.exe
  2⤵
  PID:5056
- C:\Windows\System\jeWMcjx.exe
  C:\Windows\System\jeWMcjx.exe
  2⤵
  PID:5656
- C:\Windows\System\lCjYxEo.exe
  C:\Windows\System\lCjYxEo.exe
  2⤵
  PID:1168
- C:\Windows\System\nqqgJBY.exe
  C:\Windows\System\nqqgJBY.exe
  2⤵
  PID:1448
- C:\Windows\System\eNxSysa.exe
  C:\Windows\System\eNxSysa.exe
  2⤵
  PID:1240
- C:\Windows\System\AFuelAL.exe
  C:\Windows\System\AFuelAL.exe
  2⤵
  PID:3720
- C:\Windows\System\plAVANq.exe
  C:\Windows\System\plAVANq.exe
  2⤵
  PID:3464
- C:\Windows\System\JlwqIXQ.exe
  C:\Windows\System\JlwqIXQ.exe
  2⤵
  PID:4324
- C:\Windows\System\oiLXNlZ.exe
  C:\Windows\System\oiLXNlZ.exe
  2⤵
  PID:4044
- C:\Windows\System\gmqftpX.exe
  C:\Windows\System\gmqftpX.exe
  2⤵
  PID:3428
- C:\Windows\System\tvoQYqg.exe
  C:\Windows\System\tvoQYqg.exe
  2⤵
  PID:4200
- C:\Windows\System\ivJxfWL.exe
  C:\Windows\System\ivJxfWL.exe
  2⤵
  PID:4440
- C:\Windows\System\yDajZPV.exe
  C:\Windows\System\yDajZPV.exe
  2⤵
  PID:4460
- C:\Windows\System\zPveccq.exe
  C:\Windows\System\zPveccq.exe
  2⤵
  PID:5232
- C:\Windows\System\oTUBnAm.exe
  C:\Windows\System\oTUBnAm.exe
  2⤵
  PID:5236
- C:\Windows\System\qJxnmod.exe
  C:\Windows\System\qJxnmod.exe
  2⤵
  PID:5408
- C:\Windows\System\vMRyfrm.exe
  C:\Windows\System\vMRyfrm.exe
  2⤵
  PID:5740
- C:\Windows\System\BDSDmPL.exe
  C:\Windows\System\BDSDmPL.exe
  2⤵
  PID:480
- C:\Windows\System\UyuiDoI.exe
  C:\Windows\System\UyuiDoI.exe
  2⤵
  PID:1660
- C:\Windows\System\edUhNzz.exe
  C:\Windows\System\edUhNzz.exe
  2⤵
  PID:2304
- C:\Windows\System\IsOjLHs.exe
  C:\Windows\System\IsOjLHs.exe
  2⤵
  PID:5980
- C:\Windows\System\CnuhFtc.exe
  C:\Windows\System\CnuhFtc.exe
  2⤵
  PID:2988
- C:\Windows\System\uqCpLsz.exe
  C:\Windows\System\uqCpLsz.exe
  2⤵
  PID:892
- C:\Windows\System\oGaEWbT.exe
  C:\Windows\System\oGaEWbT.exe
  2⤵
  PID:908
- C:\Windows\System\LljzcjH.exe
  C:\Windows\System\LljzcjH.exe
  2⤵
  PID:6092
- C:\Windows\System\ftMxGSm.exe
  C:\Windows\System\ftMxGSm.exe
  2⤵
  PID:1160
- C:\Windows\System\FLGekOW.exe
  C:\Windows\System\FLGekOW.exe
  2⤵
  PID:3060
- C:\Windows\System\FXYXuTR.exe
  C:\Windows\System\FXYXuTR.exe
  2⤵
  PID:3884
- C:\Windows\System\LkJjlws.exe
  C:\Windows\System\LkJjlws.exe
  2⤵
  PID:1108
- C:\Windows\System\tngboku.exe
  C:\Windows\System\tngboku.exe
  2⤵
  PID:4744
- C:\Windows\System\cDrkPCl.exe
  C:\Windows\System\cDrkPCl.exe
  2⤵
  PID:2464
- C:\Windows\System\FYfFVPe.exe
  C:\Windows\System\FYfFVPe.exe
  2⤵
  PID:6012
- C:\Windows\System\tXXXMup.exe
  C:\Windows\System\tXXXMup.exe
  2⤵
  PID:2272
- C:\Windows\System\NUZRuJh.exe
  C:\Windows\System\NUZRuJh.exe
  2⤵
  PID:4756
- C:\Windows\System\ZpSeOHQ.exe
  C:\Windows\System\ZpSeOHQ.exe
  2⤵
  PID:5772
- C:\Windows\System\FppLJMr.exe
  C:\Windows\System\FppLJMr.exe
  2⤵
  PID:4336
- C:\Windows\System\LzvNayH.exe
  C:\Windows\System\LzvNayH.exe
  2⤵
  PID:5184
- C:\Windows\System\ewnyUFN.exe
  C:\Windows\System\ewnyUFN.exe
  2⤵
  PID:3788
- C:\Windows\System\FYKOlKR.exe
  C:\Windows\System\FYKOlKR.exe
  2⤵
  PID:1400
- C:\Windows\System\KqWlduo.exe
  C:\Windows\System\KqWlduo.exe
  2⤵
  PID:4536
- C:\Windows\System\USlLafW.exe
  C:\Windows\System\USlLafW.exe
  2⤵
  PID:4152
- C:\Windows\System\PneVAlb.exe
  C:\Windows\System\PneVAlb.exe
  2⤵
  PID:5260
- C:\Windows\System\fbnCwFy.exe
  C:\Windows\System\fbnCwFy.exe
  2⤵
  PID:1568
- C:\Windows\System\tElDfwn.exe
  C:\Windows\System\tElDfwn.exe
  2⤵
  PID:2324
- C:\Windows\System\eucuNZI.exe
  C:\Windows\System\eucuNZI.exe
  2⤵
  PID:4024
- C:\Windows\System\SghwqFM.exe
  C:\Windows\System\SghwqFM.exe
  2⤵
  PID:4300
- C:\Windows\System\XcJPjsn.exe
  C:\Windows\System\XcJPjsn.exe
  2⤵
  PID:4304
- C:\Windows\System\UcXoETM.exe
  C:\Windows\System\UcXoETM.exe
  2⤵
  PID:2924
- C:\Windows\System\cfRiPJd.exe
  C:\Windows\System\cfRiPJd.exe
  2⤵
  PID:3108
- C:\Windows\System\MsmiNAX.exe
  C:\Windows\System\MsmiNAX.exe
  2⤵
  PID:5344
- C:\Windows\System\pxJTSFL.exe
  C:\Windows\System\pxJTSFL.exe
  2⤵
  PID:5640
- C:\Windows\System\IeGZeog.exe
  C:\Windows\System\IeGZeog.exe
  2⤵
  PID:5672
- C:\Windows\System\urGdUzP.exe
  C:\Windows\System\urGdUzP.exe
  2⤵
  PID:5760
- C:\Windows\System\RBzNENZ.exe
  C:\Windows\System\RBzNENZ.exe
  2⤵
  PID:2928
- C:\Windows\System\eTFQKFG.exe
  C:\Windows\System\eTFQKFG.exe
  2⤵
  PID:1432
- C:\Windows\System\WqGodBO.exe
  C:\Windows\System\WqGodBO.exe
  2⤵
  PID:6028
- C:\Windows\System\CPVYJvE.exe
  C:\Windows\System\CPVYJvE.exe
  2⤵
  PID:5804
- C:\Windows\System\GlkTVSa.exe
  C:\Windows\System\GlkTVSa.exe
  2⤵
  PID:5968
- C:\Windows\System\cZZbGHS.exe
  C:\Windows\System\cZZbGHS.exe
  2⤵
  PID:5916
- C:\Windows\System\uiqylvj.exe
  C:\Windows\System\uiqylvj.exe
  2⤵
  PID:2736
- C:\Windows\System\TORGRZg.exe
  C:\Windows\System\TORGRZg.exe
  2⤵
  PID:6088
- C:\Windows\System\XfcZGkk.exe
  C:\Windows\System\XfcZGkk.exe
  2⤵
  PID:5756
- C:\Windows\System\pVrzCgI.exe
  C:\Windows\System\pVrzCgI.exe
  2⤵
  PID:2796
- C:\Windows\System\MRcddsn.exe
  C:\Windows\System\MRcddsn.exe
  2⤵
  PID:6136
- C:\Windows\System\WWvOtRX.exe
  C:\Windows\System\WWvOtRX.exe
  2⤵
  PID:4740
- C:\Windows\System\PfwZWUY.exe
  C:\Windows\System\PfwZWUY.exe
  2⤵
  PID:6116
- C:\Windows\System\OvPAXLp.exe
  C:\Windows\System\OvPAXLp.exe
  2⤵
  PID:4696
- C:\Windows\System\HwwFUUk.exe
  C:\Windows\System\HwwFUUk.exe
  2⤵
  PID:4876
- C:\Windows\System\DRzXfBs.exe
  C:\Windows\System\DRzXfBs.exe
  2⤵
  PID:4832
- C:\Windows\System\iMGKsgk.exe
  C:\Windows\System\iMGKsgk.exe
  2⤵
  PID:3904
- C:\Windows\System\JDluSkb.exe
  C:\Windows\System\JDluSkb.exe
  2⤵
  PID:4136
- C:\Windows\System\BXJjGkR.exe
  C:\Windows\System\BXJjGkR.exe
  2⤵
  PID:5524
- C:\Windows\System\QJEKdbL.exe
  C:\Windows\System\QJEKdbL.exe
  2⤵
  PID:5248
- C:\Windows\System\izpaTxm.exe
  C:\Windows\System\izpaTxm.exe
  2⤵
  PID:328
- C:\Windows\System\qdUqvDA.exe
  C:\Windows\System\qdUqvDA.exe
  2⤵
  PID:5592
- C:\Windows\System\BTfqmHj.exe
  C:\Windows\System\BTfqmHj.exe
  2⤵
  PID:4060
- C:\Windows\System\eXrdmlu.exe
  C:\Windows\System\eXrdmlu.exe
  2⤵
  PID:5764
- C:\Windows\System\fVFhkbZ.exe
  C:\Windows\System\fVFhkbZ.exe
  2⤵
  PID:1540
- C:\Windows\System\psVnovS.exe
  C:\Windows\System\psVnovS.exe
  2⤵
  PID:5544
- C:\Windows\System\BcMtnTU.exe
  C:\Windows\System\BcMtnTU.exe
  2⤵
  PID:5680
- C:\Windows\System\VAtHqhb.exe
  C:\Windows\System\VAtHqhb.exe
  2⤵
  PID:6004
- C:\Windows\System\IbIahfI.exe
  C:\Windows\System\IbIahfI.exe
  2⤵
  PID:5928
- C:\Windows\System\yOXVoLE.exe
  C:\Windows\System\yOXVoLE.exe
  2⤵
  PID:2980
- C:\Windows\System\vEvngfz.exe
  C:\Windows\System\vEvngfz.exe
  2⤵
  PID:3360
- C:\Windows\System\xxjplSk.exe
  C:\Windows\System\xxjplSk.exe
  2⤵
  PID:4400
- C:\Windows\System\EeMQBlx.exe
  C:\Windows\System\EeMQBlx.exe
  2⤵
  PID:6052
- C:\Windows\System\AnGFCjO.exe
  C:\Windows\System\AnGFCjO.exe
  2⤵
  PID:6024
- C:\Windows\System\nwlFhZO.exe
  C:\Windows\System\nwlFhZO.exe
  2⤵
  PID:4272
- C:\Windows\System\guhxPat.exe
  C:\Windows\System\guhxPat.exe
  2⤵
  PID:5608
- C:\Windows\System\PHRBwtW.exe
  C:\Windows\System\PHRBwtW.exe
  2⤵
  PID:1760
- C:\Windows\System\uLyoxRw.exe
  C:\Windows\System\uLyoxRw.exe
  2⤵
  PID:5900
- C:\Windows\System\Fkscueq.exe
  C:\Windows\System\Fkscueq.exe
  2⤵
  PID:3640
- C:\Windows\System\EIDjBBN.exe
  C:\Windows\System\EIDjBBN.exe
  2⤵
  PID:4496
- C:\Windows\System\ZQEUfik.exe
  C:\Windows\System\ZQEUfik.exe
  2⤵
  PID:3656
- C:\Windows\System\LRjDYvq.exe
  C:\Windows\System\LRjDYvq.exe
  2⤵
  PID:5952
- C:\Windows\System\jlVQQIv.exe
  C:\Windows\System\jlVQQIv.exe
  2⤵
  PID:6152
- C:\Windows\System\pwekTTv.exe
  C:\Windows\System\pwekTTv.exe
  2⤵
  PID:6168
- C:\Windows\System\IFPwxrF.exe
  C:\Windows\System\IFPwxrF.exe
  2⤵
  PID:6184
- C:\Windows\System\JBWUcTy.exe
  C:\Windows\System\JBWUcTy.exe
  2⤵
  PID:6200
- C:\Windows\System\hTXTagw.exe
  C:\Windows\System\hTXTagw.exe
  2⤵
  PID:6216
- C:\Windows\System\FXGZgUT.exe
  C:\Windows\System\FXGZgUT.exe
  2⤵
  PID:6232
- C:\Windows\System\YIkSOHA.exe
  C:\Windows\System\YIkSOHA.exe
  2⤵
  PID:6248
- C:\Windows\System\xmoCknj.exe
  C:\Windows\System\xmoCknj.exe
  2⤵
  PID:6264
- C:\Windows\System\GCqrvrf.exe
  C:\Windows\System\GCqrvrf.exe
  2⤵
  PID:6280
- C:\Windows\System\lxLATaO.exe
  C:\Windows\System\lxLATaO.exe
  2⤵
  PID:6300
- C:\Windows\System\jZHEJhi.exe
  C:\Windows\System\jZHEJhi.exe
  2⤵
  PID:6316
- C:\Windows\System\tCBnJox.exe
  C:\Windows\System\tCBnJox.exe
  2⤵
  PID:6332
- C:\Windows\System\tmCMZff.exe
  C:\Windows\System\tmCMZff.exe
  2⤵
  PID:6348
- C:\Windows\System\lilaOzC.exe
  C:\Windows\System\lilaOzC.exe
  2⤵
  PID:6364
- C:\Windows\System\eNfceMc.exe
  C:\Windows\System\eNfceMc.exe
  2⤵
  PID:6380
- C:\Windows\System\PvAhbdv.exe
  C:\Windows\System\PvAhbdv.exe
  2⤵
  PID:6396
- C:\Windows\System\UUHqTYq.exe
  C:\Windows\System\UUHqTYq.exe
  2⤵
  PID:6412
- C:\Windows\System\kNAPYyR.exe
  C:\Windows\System\kNAPYyR.exe
  2⤵
  PID:6428
- C:\Windows\System\qsEDuhl.exe
  C:\Windows\System\qsEDuhl.exe
  2⤵
  PID:6444
- C:\Windows\System\KYdHMLY.exe
  C:\Windows\System\KYdHMLY.exe
  2⤵
  PID:6468
- C:\Windows\System\tFmNvhq.exe
  C:\Windows\System\tFmNvhq.exe
  2⤵
  PID:6484
- C:\Windows\System\UddmRXt.exe
  C:\Windows\System\UddmRXt.exe
  2⤵
  PID:6500
- C:\Windows\System\sIpYlnh.exe
  C:\Windows\System\sIpYlnh.exe
  2⤵
  PID:6612
- C:\Windows\System\NkOProG.exe
  C:\Windows\System\NkOProG.exe
  2⤵
  PID:6628
- C:\Windows\System\wzNOLXJ.exe
  C:\Windows\System\wzNOLXJ.exe
  2⤵
  PID:6644
- C:\Windows\System\sTDpCnn.exe
  C:\Windows\System\sTDpCnn.exe
  2⤵
  PID:6660
- C:\Windows\System\kmEnHMe.exe
  C:\Windows\System\kmEnHMe.exe
  2⤵
  PID:6676
- C:\Windows\System\SyCQdDI.exe
  C:\Windows\System\SyCQdDI.exe
  2⤵
  PID:6692
- C:\Windows\System\wlNkEYT.exe
  C:\Windows\System\wlNkEYT.exe
  2⤵
  PID:6708
- C:\Windows\System\TgiPVdx.exe
  C:\Windows\System\TgiPVdx.exe
  2⤵
  PID:6724
- C:\Windows\System\jWXvRSL.exe
  C:\Windows\System\jWXvRSL.exe
  2⤵
  PID:6740
- C:\Windows\System\jewznbM.exe
  C:\Windows\System\jewznbM.exe
  2⤵
  PID:6756
- C:\Windows\System\TvYwyLf.exe
  C:\Windows\System\TvYwyLf.exe
  2⤵
  PID:6772
- C:\Windows\System\wtEMTYI.exe
  C:\Windows\System\wtEMTYI.exe
  2⤵
  PID:6788
- C:\Windows\System\ifjLyCl.exe
  C:\Windows\System\ifjLyCl.exe
  2⤵
  PID:6804
- C:\Windows\System\aqnDFGz.exe
  C:\Windows\System\aqnDFGz.exe
  2⤵
  PID:6820
- C:\Windows\System\PqnsOUj.exe
  C:\Windows\System\PqnsOUj.exe
  2⤵
  PID:6844
- C:\Windows\System\uioPfxj.exe
  C:\Windows\System\uioPfxj.exe
  2⤵
  PID:6860
- C:\Windows\System\JIAZsnq.exe
  C:\Windows\System\JIAZsnq.exe
  2⤵
  PID:6880
- C:\Windows\System\xwHxmim.exe
  C:\Windows\System\xwHxmim.exe
  2⤵
  PID:6900
- C:\Windows\System\kalGQFw.exe
  C:\Windows\System\kalGQFw.exe
  2⤵
  PID:6916
- C:\Windows\System\ZQaZXqE.exe
  C:\Windows\System\ZQaZXqE.exe
  2⤵
  PID:6932
- C:\Windows\System\orJQIXg.exe
  C:\Windows\System\orJQIXg.exe
  2⤵
  PID:6948
- C:\Windows\System\lBbaGnh.exe
  C:\Windows\System\lBbaGnh.exe
  2⤵
  PID:6964
- C:\Windows\System\TCyjgZK.exe
  C:\Windows\System\TCyjgZK.exe
  2⤵
  PID:6980
- C:\Windows\System\cSPmDrs.exe
  C:\Windows\System\cSPmDrs.exe
  2⤵
  PID:6996
- C:\Windows\System\OcjeAyG.exe
  C:\Windows\System\OcjeAyG.exe
  2⤵
  PID:7012
- C:\Windows\System\XsLeDHN.exe
  C:\Windows\System\XsLeDHN.exe
  2⤵
  PID:7032
- C:\Windows\System\RxOKcSo.exe
  C:\Windows\System\RxOKcSo.exe
  2⤵
  PID:7048
- C:\Windows\System\XLHQexP.exe
  C:\Windows\System\XLHQexP.exe
  2⤵
  PID:7064
- C:\Windows\System\KyKWblX.exe
  C:\Windows\System\KyKWblX.exe
  2⤵
  PID:7080
- C:\Windows\System\yrvRRNa.exe
  C:\Windows\System\yrvRRNa.exe
  2⤵
  PID:7096
- C:\Windows\System\obDRqZO.exe
  C:\Windows\System\obDRqZO.exe
  2⤵
  PID:7112
- C:\Windows\System\nHzJTAq.exe
  C:\Windows\System\nHzJTAq.exe
  2⤵
  PID:7136
- C:\Windows\System\RektZwf.exe
  C:\Windows\System\RektZwf.exe
  2⤵
  PID:7152
- C:\Windows\System\DcYGwYL.exe
  C:\Windows\System\DcYGwYL.exe
  2⤵
  PID:2368
- C:\Windows\System\wrIQwem.exe
  C:\Windows\System\wrIQwem.exe
  2⤵
  PID:4584
- C:\Windows\System\GqMZlTK.exe
  C:\Windows\System\GqMZlTK.exe
  2⤵
  PID:6208
- C:\Windows\System\fNHllNB.exe
  C:\Windows\System\fNHllNB.exe
  2⤵
  PID:6240
- C:\Windows\System\hhhZyjs.exe
  C:\Windows\System\hhhZyjs.exe
  2⤵
  PID:5476
- C:\Windows\System\WpSecSV.exe
  C:\Windows\System\WpSecSV.exe
  2⤵
  PID:344
- C:\Windows\System\roUClGu.exe
  C:\Windows\System\roUClGu.exe
  2⤵
  PID:5540
- C:\Windows\System\QemTioc.exe
  C:\Windows\System\QemTioc.exe
  2⤵
  PID:4964
- C:\Windows\System\zAjzMRG.exe
  C:\Windows\System\zAjzMRG.exe
  2⤵
  PID:6192
- C:\Windows\System\XHvFjBS.exe
  C:\Windows\System\XHvFjBS.exe
  2⤵
  PID:6256
- C:\Windows\System\tmaicxE.exe
  C:\Windows\System\tmaicxE.exe
  2⤵
  PID:6296
- C:\Windows\System\YBfwKuA.exe
  C:\Windows\System\YBfwKuA.exe
  2⤵
  PID:6376
- C:\Windows\System\wiZZedl.exe
  C:\Windows\System\wiZZedl.exe
  2⤵
  PID:6508
- C:\Windows\System\NdaDxJN.exe
  C:\Windows\System\NdaDxJN.exe
  2⤵
  PID:6324
- C:\Windows\System\hJcUreB.exe
  C:\Windows\System\hJcUreB.exe
  2⤵
  PID:6452
- C:\Windows\System\AFUovkl.exe
  C:\Windows\System\AFUovkl.exe
  2⤵
  PID:6420
- C:\Windows\System\FHPXCpl.exe
  C:\Windows\System\FHPXCpl.exe
  2⤵
  PID:6524
- C:\Windows\System\XEBUNTy.exe
  C:\Windows\System\XEBUNTy.exe
  2⤵
  PID:6540
- C:\Windows\System\SkxtGCt.exe
  C:\Windows\System\SkxtGCt.exe
  2⤵
  PID:6560
- C:\Windows\System\HfSrkKj.exe
  C:\Windows\System\HfSrkKj.exe
  2⤵
  PID:6588
- C:\Windows\System\mXxfiWZ.exe
  C:\Windows\System\mXxfiWZ.exe
  2⤵
  PID:6600
- C:\Windows\System\WnMtKgh.exe
  C:\Windows\System\WnMtKgh.exe
  2⤵
  PID:6624
- C:\Windows\System\zjdUPpE.exe
  C:\Windows\System\zjdUPpE.exe
  2⤵
  PID:6688
- C:\Windows\System\nnAfqXE.exe
  C:\Windows\System\nnAfqXE.exe
  2⤵
  PID:6780
- C:\Windows\System\yJNAZsu.exe
  C:\Windows\System\yJNAZsu.exe
  2⤵
  PID:6704
- C:\Windows\System\liXaGhQ.exe
  C:\Windows\System\liXaGhQ.exe
  2⤵
  PID:6796
- C:\Windows\System\oyAAMZN.exe
  C:\Windows\System\oyAAMZN.exe
  2⤵
  PID:6868
- C:\Windows\System\QDqlNzi.exe
  C:\Windows\System\QDqlNzi.exe
  2⤵
  PID:6640
- C:\Windows\System\hcVptge.exe
  C:\Windows\System\hcVptge.exe
  2⤵
  PID:6940
- C:\Windows\System\yjWaFPW.exe
  C:\Windows\System\yjWaFPW.exe
  2⤵
  PID:6812
- C:\Windows\System\jgHGxLx.exe
  C:\Windows\System\jgHGxLx.exe
  2⤵
  PID:6892
- C:\Windows\System\OpDMPEV.exe
  C:\Windows\System\OpDMPEV.exe
  2⤵
  PID:6960
- C:\Windows\System\sRMWimW.exe
  C:\Windows\System\sRMWimW.exe
  2⤵
  PID:7024
- C:\Windows\System\sFHbrMW.exe
  C:\Windows\System\sFHbrMW.exe
  2⤵
  PID:7088
- C:\Windows\System\aHbWopq.exe
  C:\Windows\System\aHbWopq.exe
  2⤵
  PID:6976
- C:\Windows\System\SmgruQM.exe
  C:\Windows\System\SmgruQM.exe
  2⤵
  PID:7044
- C:\Windows\System\qASowoa.exe
  C:\Windows\System\qASowoa.exe
  2⤵
  PID:7108
- C:\Windows\System\PoNbdrq.exe
  C:\Windows\System\PoNbdrq.exe
  2⤵
  PID:7160
- C:\Windows\System\VgzPJGD.exe
  C:\Windows\System\VgzPJGD.exe
  2⤵
  PID:2636
- C:\Windows\System\tLhIAMX.exe
  C:\Windows\System\tLhIAMX.exe
  2⤵
  PID:3020
- C:\Windows\System\IaMHlNU.exe
  C:\Windows\System\IaMHlNU.exe
  2⤵
  PID:1872
- C:\Windows\System\kybdUKQ.exe
  C:\Windows\System\kybdUKQ.exe
  2⤵
  PID:5716
- C:\Windows\System\yETLnlp.exe
  C:\Windows\System\yETLnlp.exe
  2⤵
  PID:6224
- C:\Windows\System\RzLJUmu.exe
  C:\Windows\System\RzLJUmu.exe
  2⤵
  PID:6340
- C:\Windows\System\AyBxjhn.exe
  C:\Windows\System\AyBxjhn.exe
  2⤵
  PID:6512
- C:\Windows\System\TImiTiy.exe
  C:\Windows\System\TImiTiy.exe
  2⤵
  PID:6356
- C:\Windows\System\uITZIpU.exe
  C:\Windows\System\uITZIpU.exe
  2⤵
  PID:6576
- C:\Windows\System\KvurQml.exe
  C:\Windows\System\KvurQml.exe
  2⤵
  PID:6608
- C:\Windows\System\BeHoMMy.exe
  C:\Windows\System\BeHoMMy.exe
  2⤵
  PID:6752
- C:\Windows\System\cyXoipQ.exe
  C:\Windows\System\cyXoipQ.exe
  2⤵
  PID:6912
- C:\Windows\System\GLFBTLw.exe
  C:\Windows\System\GLFBTLw.exe
  2⤵
  PID:6928
- C:\Windows\System\qzmUenB.exe
  C:\Windows\System\qzmUenB.exe
  2⤵
  PID:7060
- C:\Windows\System\XvppBAA.exe
  C:\Windows\System\XvppBAA.exe
  2⤵
  PID:6328
- C:\Windows\System\mwOMjEw.exe
  C:\Windows\System\mwOMjEw.exe
  2⤵
  PID:6496
- C:\Windows\System\xyeONIb.exe
  C:\Windows\System\xyeONIb.exe
  2⤵
  PID:2824
- C:\Windows\System\mCQboEL.exe
  C:\Windows\System\mCQboEL.exe
  2⤵
  PID:6684
- C:\Windows\System\twmtAZY.exe
  C:\Windows\System\twmtAZY.exe
  2⤵
  PID:6840
- C:\Windows\System\gbiymhO.exe
  C:\Windows\System\gbiymhO.exe
  2⤵
  PID:6876
- C:\Windows\System\mqmlVeu.exe
  C:\Windows\System\mqmlVeu.exe
  2⤵
  PID:6972
- C:\Windows\System\VVxKbAO.exe
  C:\Windows\System\VVxKbAO.exe
  2⤵
  PID:7120
- C:\Windows\System\sSPBCSh.exe
  C:\Windows\System\sSPBCSh.exe
  2⤵
  PID:5888
- C:\Windows\System\algcpgc.exe
  C:\Windows\System\algcpgc.exe
  2⤵
  PID:6160
- C:\Windows\System\IfPcyBE.exe
  C:\Windows\System\IfPcyBE.exe
  2⤵
  PID:6228
- C:\Windows\System\AvHNxrn.exe
  C:\Windows\System\AvHNxrn.exe
  2⤵
  PID:6292
- C:\Windows\System\KYGnsOw.exe
  C:\Windows\System\KYGnsOw.exe
  2⤵
  PID:6764
- C:\Windows\System\boxiPvn.exe
  C:\Windows\System\boxiPvn.exe
  2⤵
  PID:6572
- C:\Windows\System\YCxZBxb.exe
  C:\Windows\System\YCxZBxb.exe
  2⤵
  PID:6852
- C:\Windows\System\DLPloLr.exe
  C:\Windows\System\DLPloLr.exe
  2⤵
  PID:6556
- C:\Windows\System\FQDYPRx.exe
  C:\Windows\System\FQDYPRx.exe
  2⤵
  PID:7020
- C:\Windows\System\LqENIwA.exe
  C:\Windows\System\LqENIwA.exe
  2⤵
  PID:6276
- C:\Windows\System\MrQTOqQ.exe
  C:\Windows\System\MrQTOqQ.exe
  2⤵
  PID:6584
- C:\Windows\System\dNwxppF.exe
  C:\Windows\System\dNwxppF.exe
  2⤵
  PID:6360
- C:\Windows\System\zyZPqCJ.exe
  C:\Windows\System\zyZPqCJ.exe
  2⤵
  PID:6888
- C:\Windows\System\JHAOfdd.exe
  C:\Windows\System\JHAOfdd.exe
  2⤵
  PID:6956
- C:\Windows\System\uuPNjRr.exe
  C:\Windows\System\uuPNjRr.exe
  2⤵
  PID:6180
- C:\Windows\System\XVLFVSD.exe
  C:\Windows\System\XVLFVSD.exe
  2⤵
  PID:6408
- C:\Windows\System\lVvswAt.exe
  C:\Windows\System\lVvswAt.exe
  2⤵
  PID:6836
- C:\Windows\System\myPBmEd.exe
  C:\Windows\System\myPBmEd.exe
  2⤵
  PID:6596
- C:\Windows\System\jgFiRQw.exe
  C:\Windows\System\jgFiRQw.exe
  2⤵
  PID:6536
- C:\Windows\System\zkHVBte.exe
  C:\Windows\System\zkHVBte.exe
  2⤵
  PID:6552
- C:\Windows\System\hcnkBoR.exe
  C:\Windows\System\hcnkBoR.exe
  2⤵
  PID:7104
- C:\Windows\System\DHbInne.exe
  C:\Windows\System\DHbInne.exe
  2⤵
  PID:6656
- C:\Windows\System\DKBDDgX.exe
  C:\Windows\System\DKBDDgX.exe
  2⤵
  PID:6520
- C:\Windows\System\UldHVUI.exe
  C:\Windows\System\UldHVUI.exe
  2⤵
  PID:7176
- C:\Windows\System\EGZVPQm.exe
  C:\Windows\System\EGZVPQm.exe
  2⤵
  PID:7192
- C:\Windows\System\ujvLpCu.exe
  C:\Windows\System\ujvLpCu.exe
  2⤵
  PID:7208
- C:\Windows\System\aGkgMaM.exe
  C:\Windows\System\aGkgMaM.exe
  2⤵
  PID:7224
- C:\Windows\System\CDRZixG.exe
  C:\Windows\System\CDRZixG.exe
  2⤵
  PID:7240
- C:\Windows\System\CnnINFb.exe
  C:\Windows\System\CnnINFb.exe
  2⤵
  PID:7260
- C:\Windows\System\JNpdyVc.exe
  C:\Windows\System\JNpdyVc.exe
  2⤵
  PID:7276
- C:\Windows\System\QvRaZBn.exe
  C:\Windows\System\QvRaZBn.exe
  2⤵
  PID:7292
- C:\Windows\System\nCOMJDr.exe
  C:\Windows\System\nCOMJDr.exe
  2⤵
  PID:7308
- C:\Windows\System\vRMJiCW.exe
  C:\Windows\System\vRMJiCW.exe
  2⤵
  PID:7324
- C:\Windows\System\zxkbugy.exe
  C:\Windows\System\zxkbugy.exe
  2⤵
  PID:7340
- C:\Windows\System\RdoYmiL.exe
  C:\Windows\System\RdoYmiL.exe
  2⤵
  PID:7360
- C:\Windows\System\yQYohBj.exe
  C:\Windows\System\yQYohBj.exe
  2⤵
  PID:7376
- C:\Windows\System\PBLRSVY.exe
  C:\Windows\System\PBLRSVY.exe
  2⤵
  PID:7392
- C:\Windows\System\yNoWWtf.exe
  C:\Windows\System\yNoWWtf.exe
  2⤵
  PID:7408
- C:\Windows\System\MOUclgs.exe
  C:\Windows\System\MOUclgs.exe
  2⤵
  PID:7424
- C:\Windows\System\BpaUIVN.exe
  C:\Windows\System\BpaUIVN.exe
  2⤵
  PID:7440
- C:\Windows\System\gcqfnEd.exe
  C:\Windows\System\gcqfnEd.exe
  2⤵
  PID:7456
- C:\Windows\System\FvWapYU.exe
  C:\Windows\System\FvWapYU.exe
  2⤵
  PID:7472
- C:\Windows\System\RpTNyOC.exe
  C:\Windows\System\RpTNyOC.exe
  2⤵
  PID:7488
- C:\Windows\System\tNKzHhE.exe
  C:\Windows\System\tNKzHhE.exe
  2⤵
  PID:7504
- C:\Windows\System\GOUcuoG.exe
  C:\Windows\System\GOUcuoG.exe
  2⤵
  PID:7520
- C:\Windows\System\TrxJVoG.exe
  C:\Windows\System\TrxJVoG.exe
  2⤵
  PID:7536
- C:\Windows\System\QvmmVIA.exe
  C:\Windows\System\QvmmVIA.exe
  2⤵
  PID:7552
- C:\Windows\System\FHkcljC.exe
  C:\Windows\System\FHkcljC.exe
  2⤵
  PID:7568
- C:\Windows\System\YEnhabc.exe
  C:\Windows\System\YEnhabc.exe
  2⤵
  PID:7584
- C:\Windows\System\QhwyVaD.exe
  C:\Windows\System\QhwyVaD.exe
  2⤵
  PID:7600
- C:\Windows\System\qkOaMwx.exe
  C:\Windows\System\qkOaMwx.exe
  2⤵
  PID:7616
- C:\Windows\System\qTPHANN.exe
  C:\Windows\System\qTPHANN.exe
  2⤵
  PID:7632
- C:\Windows\System\pnDYspA.exe
  C:\Windows\System\pnDYspA.exe
  2⤵
  PID:7648
- C:\Windows\System\PUVNddp.exe
  C:\Windows\System\PUVNddp.exe
  2⤵
  PID:7664
- C:\Windows\System\fSFdJCc.exe
  C:\Windows\System\fSFdJCc.exe
  2⤵
  PID:7680
- C:\Windows\System\YWEoOlZ.exe
  C:\Windows\System\YWEoOlZ.exe
  2⤵
  PID:7696
- C:\Windows\System\qrOjUIn.exe
  C:\Windows\System\qrOjUIn.exe
  2⤵
  PID:7712
- C:\Windows\System\sfcrRxJ.exe
  C:\Windows\System\sfcrRxJ.exe
  2⤵
  PID:7728
- C:\Windows\System\zfZMSJj.exe
  C:\Windows\System\zfZMSJj.exe
  2⤵
  PID:7744
- C:\Windows\System\whvZgiW.exe
  C:\Windows\System\whvZgiW.exe
  2⤵
  PID:7760
- C:\Windows\System\HYPpIEx.exe
  C:\Windows\System\HYPpIEx.exe
  2⤵
  PID:7776
- C:\Windows\System\tYLYPPA.exe
  C:\Windows\System\tYLYPPA.exe
  2⤵
  PID:7792
- C:\Windows\System\QsJkSdg.exe
  C:\Windows\System\QsJkSdg.exe
  2⤵
  PID:7808
- C:\Windows\System\jcurRVU.exe
  C:\Windows\System\jcurRVU.exe
  2⤵
  PID:7824
- C:\Windows\System\VOhzkrZ.exe
  C:\Windows\System\VOhzkrZ.exe
  2⤵
  PID:7840
- C:\Windows\System\vvubTeJ.exe
  C:\Windows\System\vvubTeJ.exe
  2⤵
  PID:7856
- C:\Windows\System\qNhOBPs.exe
  C:\Windows\System\qNhOBPs.exe
  2⤵
  PID:7872
- C:\Windows\System\pbKkQaj.exe
  C:\Windows\System\pbKkQaj.exe
  2⤵
  PID:7888
- C:\Windows\System\GwKZSeY.exe
  C:\Windows\System\GwKZSeY.exe
  2⤵
  PID:7904
- C:\Windows\System\RbSuCQN.exe
  C:\Windows\System\RbSuCQN.exe
  2⤵
  PID:7924
- C:\Windows\System\alKFChC.exe
  C:\Windows\System\alKFChC.exe
  2⤵
  PID:7940
- C:\Windows\System\XczOQXo.exe
  C:\Windows\System\XczOQXo.exe
  2⤵
  PID:7956
- C:\Windows\System\oFUCQPv.exe
  C:\Windows\System\oFUCQPv.exe
  2⤵
  PID:7972
- C:\Windows\System\jiwAjEO.exe
  C:\Windows\System\jiwAjEO.exe
  2⤵
  PID:7988
- C:\Windows\System\jHrqWyo.exe
  C:\Windows\System\jHrqWyo.exe
  2⤵
  PID:8004
- C:\Windows\System\sHolsWH.exe
  C:\Windows\System\sHolsWH.exe
  2⤵
  PID:8020
- C:\Windows\System\XbkJeXb.exe
  C:\Windows\System\XbkJeXb.exe
  2⤵
  PID:8036
- C:\Windows\System\xxcVSRm.exe
  C:\Windows\System\xxcVSRm.exe
  2⤵
  PID:8056
- C:\Windows\System\WbRgxeS.exe
  C:\Windows\System\WbRgxeS.exe
  2⤵
  PID:8080
- C:\Windows\System\bhRiXNF.exe
  C:\Windows\System\bhRiXNF.exe
  2⤵
  PID:8096
- C:\Windows\System\kWcJHSC.exe
  C:\Windows\System\kWcJHSC.exe
  2⤵
  PID:8112
- C:\Windows\System\OPYKmRQ.exe
  C:\Windows\System\OPYKmRQ.exe
  2⤵
  PID:8128
- C:\Windows\System\TJGqUFA.exe
  C:\Windows\System\TJGqUFA.exe
  2⤵
  PID:8144
- C:\Windows\System\nVtVfah.exe
  C:\Windows\System\nVtVfah.exe
  2⤵
  PID:8160
- C:\Windows\System\lZUCKWZ.exe
  C:\Windows\System\lZUCKWZ.exe
  2⤵
  PID:8176
- C:\Windows\System\JwtyerU.exe
  C:\Windows\System\JwtyerU.exe
  2⤵
  PID:6908
- C:\Windows\System\cRimWos.exe
  C:\Windows\System\cRimWos.exe
  2⤵
  PID:7128
- C:\Windows\System\oWOrlcY.exe
  C:\Windows\System\oWOrlcY.exe
  2⤵
  PID:7200
- C:\Windows\System\UaIGAyw.exe
  C:\Windows\System\UaIGAyw.exe
  2⤵
  PID:7268
- C:\Windows\System\vnPipqj.exe
  C:\Windows\System\vnPipqj.exe
  2⤵
  PID:7332
- C:\Windows\System\omaISPN.exe
  C:\Windows\System\omaISPN.exe
  2⤵
  PID:7400
- C:\Windows\System\QNMpCfq.exe
  C:\Windows\System\QNMpCfq.exe
  2⤵
  PID:7496
- C:\Windows\System\GUuIYvs.exe
  C:\Windows\System\GUuIYvs.exe
  2⤵
  PID:7560
- C:\Windows\System\ruvTllJ.exe
  C:\Windows\System\ruvTllJ.exe
  2⤵
  PID:7220
- C:\Windows\System\pvfVNHR.exe
  C:\Windows\System\pvfVNHR.exe
  2⤵
  PID:7512
- C:\Windows\System\igkPwJK.exe
  C:\Windows\System\igkPwJK.exe
  2⤵
  PID:7576
- C:\Windows\System\WQaFIPW.exe
  C:\Windows\System\WQaFIPW.exe
  2⤵
  PID:7356
- C:\Windows\System\pnzhFit.exe
  C:\Windows\System\pnzhFit.exe
  2⤵
  PID:7320
- C:\Windows\System\ArENrGd.exe
  C:\Windows\System\ArENrGd.exe
  2⤵
  PID:7416
- C:\Windows\System\gQQCfGi.exe
  C:\Windows\System\gQQCfGi.exe
  2⤵
  PID:7484
- C:\Windows\System\WMANlpG.exe
  C:\Windows\System\WMANlpG.exe
  2⤵
  PID:7644
- C:\Windows\System\iKoQxFG.exe
  C:\Windows\System\iKoQxFG.exe
  2⤵
  PID:7660
- C:\Windows\System\qZPzAVR.exe
  C:\Windows\System\qZPzAVR.exe
  2⤵
  PID:7836
- C:\Windows\System\PMlZUDe.exe
  C:\Windows\System\PMlZUDe.exe
  2⤵
  PID:7900
- C:\Windows\System\QatdWYd.exe
  C:\Windows\System\QatdWYd.exe
  2⤵
  PID:7932
- C:\Windows\System\cNBBOmh.exe
  C:\Windows\System\cNBBOmh.exe
  2⤵
  PID:7996
- C:\Windows\System\DgNiGGy.exe
  C:\Windows\System\DgNiGGy.exe
  2⤵
  PID:8032
- C:\Windows\System\HpmtDRn.exe
  C:\Windows\System\HpmtDRn.exe
  2⤵
  PID:8120
- C:\Windows\System\QdxFlgc.exe
  C:\Windows\System\QdxFlgc.exe
  2⤵
  PID:8156
- C:\Windows\System\MFDzrit.exe
  C:\Windows\System\MFDzrit.exe
  2⤵
  PID:3740
- C:\Windows\System\HRzNWIz.exe
  C:\Windows\System\HRzNWIz.exe
  2⤵
  PID:8140
- C:\Windows\System\dGfvfqq.exe
  C:\Windows\System\dGfvfqq.exe
  2⤵
  PID:7372
- C:\Windows\System\KgYEIll.exe
  C:\Windows\System\KgYEIll.exe
  2⤵
  PID:7256
- C:\Windows\System\omGSpPc.exe
  C:\Windows\System\omGSpPc.exe
  2⤵
  PID:7388
- C:\Windows\System\LuYqZTk.exe
  C:\Windows\System\LuYqZTk.exe
  2⤵
  PID:3004
- C:\Windows\System\MwXaAXL.exe
  C:\Windows\System\MwXaAXL.exe
  2⤵
  PID:7720
- C:\Windows\System\JvZkbTB.exe
  C:\Windows\System\JvZkbTB.exe
  2⤵
  PID:7704
- C:\Windows\System\YQSFvIX.exe
  C:\Windows\System\YQSFvIX.exe
  2⤵
  PID:7740
- C:\Windows\System\MsvqGCT.exe
  C:\Windows\System\MsvqGCT.exe
  2⤵
  PID:7304
- C:\Windows\System\TVvQFok.exe
  C:\Windows\System\TVvQFok.exe
  2⤵
  PID:7468
- C:\Windows\System\DYzHzDU.exe
  C:\Windows\System\DYzHzDU.exe
  2⤵
  PID:7548
- C:\Windows\System\fZWJtQp.exe
  C:\Windows\System\fZWJtQp.exe
  2⤵
  PID:7480
- C:\Windows\System\MjmMMGZ.exe
  C:\Windows\System\MjmMMGZ.exe
  2⤵
  PID:7820
- C:\Windows\System\VRyvZnm.exe
  C:\Windows\System\VRyvZnm.exe
  2⤵
  PID:7852
- C:\Windows\System\pnoqlBV.exe
  C:\Windows\System\pnoqlBV.exe
  2⤵
  PID:7884
- C:\Windows\System\wRKBdAD.exe
  C:\Windows\System\wRKBdAD.exe
  2⤵
  PID:7948
- C:\Windows\System\arCGRee.exe
  C:\Windows\System\arCGRee.exe
  2⤵
  PID:8012
- C:\Windows\System\KKwMBsJ.exe
  C:\Windows\System\KKwMBsJ.exe
  2⤵
  PID:8052
- C:\Windows\System\nMbbNEG.exe
  C:\Windows\System\nMbbNEG.exe
  2⤵
  PID:7968
- C:\Windows\System\ZNiUTMl.exe
  C:\Windows\System\ZNiUTMl.exe
  2⤵
  PID:8188
- C:\Windows\System\XMLuUbh.exe
  C:\Windows\System\XMLuUbh.exe
  2⤵
  PID:7384
- C:\Windows\System\kcgytwV.exe
  C:\Windows\System\kcgytwV.exe
  2⤵
  PID:7752
- C:\Windows\System\xHnzOnv.exe
  C:\Windows\System\xHnzOnv.exe
  2⤵
  PID:7252
- C:\Windows\System\cXKJuhF.exe
  C:\Windows\System\cXKJuhF.exe
  2⤵
  PID:8152
- C:\Windows\System\wMNyazE.exe
  C:\Windows\System\wMNyazE.exe
  2⤵
  PID:7676
- C:\Windows\System\oxhwHhc.exe
  C:\Windows\System\oxhwHhc.exe
  2⤵
  PID:7316
- C:\Windows\System\VXMnFti.exe
  C:\Windows\System\VXMnFti.exe
  2⤵
  PID:7640
- C:\Windows\System\kSdgDNX.exe
  C:\Windows\System\kSdgDNX.exe
  2⤵
  PID:7916
- C:\Windows\System\AhJBful.exe
  C:\Windows\System\AhJBful.exe
  2⤵
  PID:7216
- C:\Windows\System\uuEYfHW.exe
  C:\Windows\System\uuEYfHW.exe
  2⤵
  PID:7880
- C:\Windows\System\bswuQLM.exe
  C:\Windows\System\bswuQLM.exe
  2⤵
  PID:7896
- C:\Windows\System\cMWSupT.exe
  C:\Windows\System\cMWSupT.exe
  2⤵
  PID:7236
- C:\Windows\System\CTIcAxo.exe
  C:\Windows\System\CTIcAxo.exe
  2⤵
  PID:7436
- C:\Windows\System\vwkfycN.exe
  C:\Windows\System\vwkfycN.exe
  2⤵
  PID:8048
- C:\Windows\System\lkpWVox.exe
  C:\Windows\System\lkpWVox.exe
  2⤵
  PID:7768
- C:\Windows\System\DULxrHi.exe
  C:\Windows\System\DULxrHi.exe
  2⤵
  PID:8204
- C:\Windows\System\ZsxFzeJ.exe
  C:\Windows\System\ZsxFzeJ.exe
  2⤵
  PID:8220
- C:\Windows\System\mQjXNSt.exe
  C:\Windows\System\mQjXNSt.exe
  2⤵
  PID:8236
- C:\Windows\System\VtmZCZU.exe
  C:\Windows\System\VtmZCZU.exe
  2⤵
  PID:8252
- C:\Windows\System\RPtKcmm.exe
  C:\Windows\System\RPtKcmm.exe
  2⤵
  PID:8268
- C:\Windows\System\BaUxItg.exe
  C:\Windows\System\BaUxItg.exe
  2⤵
  PID:8284
- C:\Windows\System\gLoECiX.exe
  C:\Windows\System\gLoECiX.exe
  2⤵
  PID:8300
- C:\Windows\System\PweRGTn.exe
  C:\Windows\System\PweRGTn.exe
  2⤵
  PID:8316
- C:\Windows\System\MPAlInz.exe
  C:\Windows\System\MPAlInz.exe
  2⤵
  PID:8336
- C:\Windows\System\MwLmgnj.exe
  C:\Windows\System\MwLmgnj.exe
  2⤵
  PID:8352
- C:\Windows\System\YwbvnAy.exe
  C:\Windows\System\YwbvnAy.exe
  2⤵
  PID:8368
- C:\Windows\System\GdStIfk.exe
  C:\Windows\System\GdStIfk.exe
  2⤵
  PID:8384
- C:\Windows\System\PFLjlkr.exe
  C:\Windows\System\PFLjlkr.exe
  2⤵
  PID:8400
- C:\Windows\System\RbPMnru.exe
  C:\Windows\System\RbPMnru.exe
  2⤵
  PID:8416
- C:\Windows\System\oSqTVIF.exe
  C:\Windows\System\oSqTVIF.exe
  2⤵
  PID:8432
- C:\Windows\System\cdXblbs.exe
  C:\Windows\System\cdXblbs.exe
  2⤵
  PID:8448
- C:\Windows\System\PJnDGJf.exe
  C:\Windows\System\PJnDGJf.exe
  2⤵
  PID:8464
- C:\Windows\System\CsvpYwQ.exe
  C:\Windows\System\CsvpYwQ.exe
  2⤵
  PID:8480
- C:\Windows\System\lKonxqr.exe
  C:\Windows\System\lKonxqr.exe
  2⤵
  PID:8500
- C:\Windows\System\KsZWWQK.exe
  C:\Windows\System\KsZWWQK.exe
  2⤵
  PID:8516
- C:\Windows\System\VpLAYaW.exe
  C:\Windows\System\VpLAYaW.exe
  2⤵
  PID:8532
- C:\Windows\System\VYefdfZ.exe
  C:\Windows\System\VYefdfZ.exe
  2⤵
  PID:8548
- C:\Windows\System\CbtXqkm.exe
  C:\Windows\System\CbtXqkm.exe
  2⤵
  PID:8564
- C:\Windows\System\GlmFuLj.exe
  C:\Windows\System\GlmFuLj.exe
  2⤵
  PID:8580
- C:\Windows\System\HiQGaOW.exe
  C:\Windows\System\HiQGaOW.exe
  2⤵
  PID:8596
- C:\Windows\System\DZbqnhj.exe
  C:\Windows\System\DZbqnhj.exe
  2⤵
  PID:8612
- C:\Windows\System\PjqNaiW.exe
  C:\Windows\System\PjqNaiW.exe
  2⤵
  PID:8628
- C:\Windows\System\yMgsyvJ.exe
  C:\Windows\System\yMgsyvJ.exe
  2⤵
  PID:8644
- C:\Windows\System\slLYMXJ.exe
  C:\Windows\System\slLYMXJ.exe
  2⤵
  PID:8660
- C:\Windows\System\hntCwGQ.exe
  C:\Windows\System\hntCwGQ.exe
  2⤵
  PID:8676
- C:\Windows\System\xBaHYvs.exe
  C:\Windows\System\xBaHYvs.exe
  2⤵
  PID:8692
- C:\Windows\System\mdoSjWQ.exe
  C:\Windows\System\mdoSjWQ.exe
  2⤵
  PID:8708
- C:\Windows\System\VWJyAGf.exe
  C:\Windows\System\VWJyAGf.exe
  2⤵
  PID:8724
- C:\Windows\System\ueBsGCT.exe
  C:\Windows\System\ueBsGCT.exe
  2⤵
  PID:8740
- C:\Windows\System\fLibIdJ.exe
  C:\Windows\System\fLibIdJ.exe
  2⤵
  PID:8756
- C:\Windows\System\WYopvvm.exe
  C:\Windows\System\WYopvvm.exe
  2⤵
  PID:8772
- C:\Windows\System\HuiThIO.exe
  C:\Windows\System\HuiThIO.exe
  2⤵
  PID:8880
- C:\Windows\System\KtREgMg.exe
  C:\Windows\System\KtREgMg.exe
  2⤵
  PID:8896
- C:\Windows\System\pYgOVor.exe
  C:\Windows\System\pYgOVor.exe
  2⤵
  PID:8912
- C:\Windows\System\vKyFfvO.exe
  C:\Windows\System\vKyFfvO.exe
  2⤵
  PID:8928
- C:\Windows\System\WmqxLwo.exe
  C:\Windows\System\WmqxLwo.exe
  2⤵
  PID:8948
- C:\Windows\System\jInMmGX.exe
  C:\Windows\System\jInMmGX.exe
  2⤵
  PID:8964
- C:\Windows\System\cvtLVlr.exe
  C:\Windows\System\cvtLVlr.exe
  2⤵
  PID:8980
- C:\Windows\System\vqTTVUd.exe
  C:\Windows\System\vqTTVUd.exe
  2⤵
  PID:8996
- C:\Windows\System\JNUlaGY.exe
  C:\Windows\System\JNUlaGY.exe
  2⤵
  PID:9012
- C:\Windows\System\JgIKSQS.exe
  C:\Windows\System\JgIKSQS.exe
  2⤵
  PID:9028
- C:\Windows\System\JomXDMB.exe
  C:\Windows\System\JomXDMB.exe
  2⤵
  PID:9044
- C:\Windows\System\UfkjLIM.exe
  C:\Windows\System\UfkjLIM.exe
  2⤵
  PID:9060
- C:\Windows\System\fCmANpN.exe
  C:\Windows\System\fCmANpN.exe
  2⤵
  PID:9076
- C:\Windows\System\iRUpvYb.exe
  C:\Windows\System\iRUpvYb.exe
  2⤵
  PID:9092
- C:\Windows\System\SWwqVCQ.exe
  C:\Windows\System\SWwqVCQ.exe
  2⤵
  PID:9108
- C:\Windows\System\MeFisDu.exe
  C:\Windows\System\MeFisDu.exe
  2⤵
  PID:9124
- C:\Windows\System\qNlfxZJ.exe
  C:\Windows\System\qNlfxZJ.exe
  2⤵
  PID:9140
- C:\Windows\System\bGZwIua.exe
  C:\Windows\System\bGZwIua.exe
  2⤵
  PID:9160
- C:\Windows\System\livHlAb.exe
  C:\Windows\System\livHlAb.exe
  2⤵
  PID:9176
- C:\Windows\System\RPPinym.exe
  C:\Windows\System\RPPinym.exe
  2⤵
  PID:9200
- C:\Windows\System\JGjBGkD.exe
  C:\Windows\System\JGjBGkD.exe
  2⤵
  PID:8076
- C:\Windows\System\wIHyzxz.exe
  C:\Windows\System\wIHyzxz.exe
  2⤵
  PID:8184
- C:\Windows\System\ZyfSjPq.exe
  C:\Windows\System\ZyfSjPq.exe
  2⤵
  PID:7984
- C:\Windows\System\rtZNUsl.exe
  C:\Windows\System\rtZNUsl.exe
  2⤵
  PID:7368
- C:\Windows\System\UJFDaUi.exe
  C:\Windows\System\UJFDaUi.exe
  2⤵
  PID:8064
- C:\Windows\System\znMdqqu.exe
  C:\Windows\System\znMdqqu.exe
  2⤵
  PID:8232
- C:\Windows\System\fDMSQyR.exe
  C:\Windows\System\fDMSQyR.exe
  2⤵
  PID:8328
- C:\Windows\System\gAQlAtI.exe
  C:\Windows\System\gAQlAtI.exe
  2⤵
  PID:8392
- C:\Windows\System\PcTADGv.exe
  C:\Windows\System\PcTADGv.exe
  2⤵
  PID:8424
- C:\Windows\System\ykkKGyr.exe
  C:\Windows\System\ykkKGyr.exe
  2⤵
  PID:8492
- C:\Windows\System\LMbUnya.exe
  C:\Windows\System\LMbUnya.exe
  2⤵
  PID:8248
- C:\Windows\System\eBuYXli.exe
  C:\Windows\System\eBuYXli.exe
  2⤵
  PID:8588
- C:\Windows\System\fbFqTpG.exe
  C:\Windows\System\fbFqTpG.exe
  2⤵
  PID:8544
- C:\Windows\System\WgLVjzj.exe
  C:\Windows\System\WgLVjzj.exe
  2⤵
  PID:8652
- C:\Windows\System\pkHOmeV.exe
  C:\Windows\System\pkHOmeV.exe
  2⤵
  PID:8716
- C:\Windows\System\EHznTJI.exe
  C:\Windows\System\EHznTJI.exe
  2⤵
  PID:8780
- C:\Windows\System\RHitOXS.exe
  C:\Windows\System\RHitOXS.exe
  2⤵
  PID:8540
- C:\Windows\System\WYHqBXe.exe
  C:\Windows\System\WYHqBXe.exe
  2⤵
  PID:8608
- C:\Windows\System\GJghftr.exe
  C:\Windows\System\GJghftr.exe
  2⤵
  PID:8668
- C:\Windows\System\TaTzjUg.exe
  C:\Windows\System\TaTzjUg.exe
  2⤵
  PID:8764
- C:\Windows\System\JRzSpcu.exe
  C:\Windows\System\JRzSpcu.exe
  2⤵
  PID:8792
- C:\Windows\System\iXvQvQq.exe
  C:\Windows\System\iXvQvQq.exe
  2⤵
  PID:8808
- C:\Windows\System\PwRbhdG.exe
  C:\Windows\System\PwRbhdG.exe
  2⤵
  PID:8828
- C:\Windows\System\bHMXPMH.exe
  C:\Windows\System\bHMXPMH.exe
  2⤵
  PID:8840
- C:\Windows\System\QqIDFCI.exe
  C:\Windows\System\QqIDFCI.exe
  2⤵
  PID:8860
- C:\Windows\System\CBiTtzR.exe
  C:\Windows\System\CBiTtzR.exe
  2⤵
  PID:8876
- C:\Windows\System\jpSeXhQ.exe
  C:\Windows\System\jpSeXhQ.exe
  2⤵
  PID:8940
- C:\Windows\System\FnYAike.exe
  C:\Windows\System\FnYAike.exe
  2⤵
  PID:9004
- C:\Windows\System\yemXoNP.exe
  C:\Windows\System\yemXoNP.exe
  2⤵
  PID:9068
- C:\Windows\System\jeqnQck.exe
  C:\Windows\System\jeqnQck.exe
  2⤵
  PID:9132
- C:\Windows\System\IFDKSpk.exe
  C:\Windows\System\IFDKSpk.exe
  2⤵
  PID:9208
- C:\Windows\System\uKXnJey.exe
  C:\Windows\System\uKXnJey.exe
  2⤵
  PID:8920
- C:\Windows\System\KUMDbki.exe
  C:\Windows\System\KUMDbki.exe
  2⤵
  PID:7848
- C:\Windows\System\ujkkkou.exe
  C:\Windows\System\ujkkkou.exe
  2⤵
  PID:8296
- C:\Windows\System\GywYWKr.exe
  C:\Windows\System\GywYWKr.exe
  2⤵
  PID:8988
- C:\Windows\System\lDPehmF.exe
  C:\Windows\System\lDPehmF.exe
  2⤵
  PID:9052
- C:\Windows\System\tvPPywv.exe
  C:\Windows\System\tvPPywv.exe
  2⤵
  PID:9116
- C:\Windows\System\oJnLpqp.exe
  C:\Windows\System\oJnLpqp.exe
  2⤵
  PID:9184
- C:\Windows\System\hwjbOtt.exe
  C:\Windows\System\hwjbOtt.exe
  2⤵
  PID:9196
- C:\Windows\System\wQvyJMM.exe
  C:\Windows\System\wQvyJMM.exe
  2⤵
  PID:8228
- C:\Windows\System\uWpwMza.exe
  C:\Windows\System\uWpwMza.exe
  2⤵
  PID:8460
- C:\Windows\System\EvdoTgo.exe
  C:\Windows\System\EvdoTgo.exe
  2⤵
  PID:8264
- C:\Windows\System\xooAQfB.exe
  C:\Windows\System\xooAQfB.exe
  2⤵
  PID:8560
- C:\Windows\System\GPsvqUp.exe
  C:\Windows\System\GPsvqUp.exe
  2⤵
  PID:8308
- C:\Windows\System\clOTUCK.exe
  C:\Windows\System\clOTUCK.exe
  2⤵
  PID:8620
- C:\Windows\System\rOlutvJ.exe
  C:\Windows\System\rOlutvJ.exe
  2⤵
  PID:1492
- C:\Windows\System\QqZIsXI.exe
  C:\Windows\System\QqZIsXI.exe
  2⤵
  PID:8376
- C:\Windows\System\dKFTaVl.exe
  C:\Windows\System\dKFTaVl.exe
  2⤵
  PID:8440
- C:\Windows\System\JEDpTyr.exe
  C:\Windows\System\JEDpTyr.exe
  2⤵
  PID:8788
- C:\Windows\System\gyDZzWb.exe
  C:\Windows\System\gyDZzWb.exe
  2⤵
  PID:8852
- C:\Windows\System\pDyZOOY.exe
  C:\Windows\System\pDyZOOY.exe
  2⤵
  PID:9036
- C:\Windows\System\tlTljIM.exe
  C:\Windows\System\tlTljIM.exe
  2⤵
  PID:8888
- C:\Windows\System\YmhXAfG.exe
  C:\Windows\System\YmhXAfG.exe
  2⤵
  PID:9084
- C:\Windows\System\UuPaxIq.exe
  C:\Windows\System\UuPaxIq.exe
  2⤵
  PID:8748
- C:\Windows\System\squBHRw.exe
  C:\Windows\System\squBHRw.exe
  2⤵
  PID:9100
- C:\Windows\System\XhrpVFn.exe
  C:\Windows\System\XhrpVFn.exe
  2⤵
  PID:8752
- C:\Windows\System\cToydvH.exe
  C:\Windows\System\cToydvH.exe
  2⤵
  PID:8972
- C:\Windows\System\LwUuKky.exe
  C:\Windows\System\LwUuKky.exe
  2⤵
  PID:8732
- C:\Windows\System\JuMtFkA.exe
  C:\Windows\System\JuMtFkA.exe
  2⤵
  PID:8872
- C:\Windows\System\kpZqovH.exe
  C:\Windows\System\kpZqovH.exe
  2⤵
  PID:9120
- C:\Windows\System\lEPLxgv.exe
  C:\Windows\System\lEPLxgv.exe
  2⤵
  PID:8488
- C:\Windows\System\VwmXhvL.exe
  C:\Windows\System\VwmXhvL.exe
  2⤵
  PID:8444
- C:\Windows\System\JuzeMxt.exe
  C:\Windows\System\JuzeMxt.exe
  2⤵
  PID:8244
- C:\Windows\System\qdSEIjf.exe
  C:\Windows\System\qdSEIjf.exe
  2⤵
  PID:8684
- C:\Windows\System\qJqmaga.exe
  C:\Windows\System\qJqmaga.exe
  2⤵
  PID:9172
- C:\Windows\System\JZchggi.exe
  C:\Windows\System\JZchggi.exe
  2⤵
  PID:9192
- C:\Windows\System\ygJqWSL.exe
  C:\Windows\System\ygJqWSL.exe
  2⤵
  PID:9212
- C:\Windows\System\TSboOGA.exe
  C:\Windows\System\TSboOGA.exe
  2⤵
  PID:8524
- C:\Windows\System\HLGOiLi.exe
  C:\Windows\System\HLGOiLi.exe
  2⤵
  PID:8572
- C:\Windows\System\kWeOaxe.exe
  C:\Windows\System\kWeOaxe.exe
  2⤵
  PID:8216
- C:\Windows\System\XFJdoJM.exe
  C:\Windows\System\XFJdoJM.exe
  2⤵
  PID:8804
- C:\Windows\System\pWvmrOF.exe
  C:\Windows\System\pWvmrOF.exe
  2⤵
  PID:7784
- C:\Windows\System\kEIPBIU.exe
  C:\Windows\System\kEIPBIU.exe
  2⤵
  PID:8396
- C:\Windows\System\AeSmlmi.exe
  C:\Windows\System\AeSmlmi.exe
  2⤵
  PID:9220
- C:\Windows\System\SNrnCxk.exe
  C:\Windows\System\SNrnCxk.exe
  2⤵
  PID:9236
- C:\Windows\System\OZCQvjn.exe
  C:\Windows\System\OZCQvjn.exe
  2⤵
  PID:9252
- C:\Windows\System\LVEYBMn.exe
  C:\Windows\System\LVEYBMn.exe
  2⤵
  PID:9268
- C:\Windows\System\oZnKdUS.exe
  C:\Windows\System\oZnKdUS.exe
  2⤵
  PID:9284
- C:\Windows\System\akXkAHG.exe
  C:\Windows\System\akXkAHG.exe
  2⤵
  PID:9300
- C:\Windows\System\CkkYNxh.exe
  C:\Windows\System\CkkYNxh.exe
  2⤵
  PID:9316
- C:\Windows\System\ySdddYo.exe
  C:\Windows\System\ySdddYo.exe
  2⤵
  PID:9332
- C:\Windows\System\emXJDru.exe
  C:\Windows\System\emXJDru.exe
  2⤵
  PID:9348
- C:\Windows\System\iAVdIiC.exe
  C:\Windows\System\iAVdIiC.exe
  2⤵
  PID:9364
- C:\Windows\System\vPSpwLy.exe
  C:\Windows\System\vPSpwLy.exe
  2⤵
  PID:9380
- C:\Windows\System\xDaoxii.exe
  C:\Windows\System\xDaoxii.exe
  2⤵
  PID:9396
- C:\Windows\System\LCtIuHh.exe
  C:\Windows\System\LCtIuHh.exe
  2⤵
  PID:9412
- C:\Windows\System\mVOMGEb.exe
  C:\Windows\System\mVOMGEb.exe
  2⤵
  PID:9428
- C:\Windows\System\Vnfaxfb.exe
  C:\Windows\System\Vnfaxfb.exe
  2⤵
  PID:9444
- C:\Windows\System\arSOiZk.exe
  C:\Windows\System\arSOiZk.exe
  2⤵
  PID:9460
- C:\Windows\System\oJnHmZa.exe
  C:\Windows\System\oJnHmZa.exe
  2⤵
  PID:9476
- C:\Windows\System\garUahK.exe
  C:\Windows\System\garUahK.exe
  2⤵
  PID:9492
- C:\Windows\System\hVUynFp.exe
  C:\Windows\System\hVUynFp.exe
  2⤵
  PID:9508
- C:\Windows\System\wIUwYlJ.exe
  C:\Windows\System\wIUwYlJ.exe
  2⤵
  PID:9524
- C:\Windows\System\VEIQFty.exe
  C:\Windows\System\VEIQFty.exe
  2⤵
  PID:9540
- C:\Windows\System\fHZmZhq.exe
  C:\Windows\System\fHZmZhq.exe
  2⤵
  PID:9556
- C:\Windows\System\UwLhNoW.exe
  C:\Windows\System\UwLhNoW.exe
  2⤵
  PID:9572
- C:\Windows\System\ptGQjTc.exe
  C:\Windows\System\ptGQjTc.exe
  2⤵
  PID:9588
- C:\Windows\System\CHVRxDZ.exe
  C:\Windows\System\CHVRxDZ.exe
  2⤵
  PID:9664
- C:\Windows\System\WbeqRpl.exe
  C:\Windows\System\WbeqRpl.exe
  2⤵
  PID:9680
- C:\Windows\System\fZcyjAE.exe
  C:\Windows\System\fZcyjAE.exe
  2⤵
  PID:9696
- C:\Windows\System\daKCQJZ.exe
  C:\Windows\System\daKCQJZ.exe
  2⤵
  PID:9716
- C:\Windows\System\riTcoPh.exe
  C:\Windows\System\riTcoPh.exe
  2⤵
  PID:9732
- C:\Windows\System\pWgZDJK.exe
  C:\Windows\System\pWgZDJK.exe
  2⤵
  PID:9748
- C:\Windows\System\QoRRsUi.exe
  C:\Windows\System\QoRRsUi.exe
  2⤵
  PID:9764
- C:\Windows\System\TKbWblI.exe
  C:\Windows\System\TKbWblI.exe
  2⤵
  PID:9780
- C:\Windows\System\XOFgMCm.exe
  C:\Windows\System\XOFgMCm.exe
  2⤵
  PID:9804
- C:\Windows\System\tvlSxgx.exe
  C:\Windows\System\tvlSxgx.exe
  2⤵
  PID:9820
- C:\Windows\System\TvFFfTw.exe
  C:\Windows\System\TvFFfTw.exe
  2⤵
  PID:9836
- C:\Windows\System\ndUzDtE.exe
  C:\Windows\System\ndUzDtE.exe
  2⤵
  PID:9852
- C:\Windows\System\pnSNoFd.exe
  C:\Windows\System\pnSNoFd.exe
  2⤵
  PID:9868
- C:\Windows\System\rsAelfp.exe
  C:\Windows\System\rsAelfp.exe
  2⤵
  PID:9888
- C:\Windows\System\NoznCcp.exe
  C:\Windows\System\NoznCcp.exe
  2⤵
  PID:9908
- C:\Windows\System\sFlOWqg.exe
  C:\Windows\System\sFlOWqg.exe
  2⤵
  PID:9924
- C:\Windows\System\rqqipmk.exe
  C:\Windows\System\rqqipmk.exe
  2⤵
  PID:9940
- C:\Windows\System\YMeTumA.exe
  C:\Windows\System\YMeTumA.exe
  2⤵
  PID:9956
- C:\Windows\System\IDEbKmi.exe
  C:\Windows\System\IDEbKmi.exe
  2⤵
  PID:9972
- C:\Windows\System\JQWEmTc.exe
  C:\Windows\System\JQWEmTc.exe
  2⤵
  PID:9988
- C:\Windows\System\mnwDCio.exe
  C:\Windows\System\mnwDCio.exe
  2⤵
  PID:10004
- C:\Windows\System\DbTlRhD.exe
  C:\Windows\System\DbTlRhD.exe
  2⤵
  PID:10020
- C:\Windows\System\wQWRzsM.exe
  C:\Windows\System\wQWRzsM.exe
  2⤵
  PID:10036
- C:\Windows\System\GAXMgiJ.exe
  C:\Windows\System\GAXMgiJ.exe
  2⤵
  PID:10052
- C:\Windows\System\SETWJgq.exe
  C:\Windows\System\SETWJgq.exe
  2⤵
  PID:10068
- C:\Windows\System\fczuGZR.exe
  C:\Windows\System\fczuGZR.exe
  2⤵
  PID:10084
- C:\Windows\System\UHtnqCQ.exe
  C:\Windows\System\UHtnqCQ.exe
  2⤵
  PID:10100
- C:\Windows\System\nNkCVHl.exe
  C:\Windows\System\nNkCVHl.exe
  2⤵
  PID:10116
- C:\Windows\System\IuACPiO.exe
  C:\Windows\System\IuACPiO.exe
  2⤵
  PID:10132
- C:\Windows\System\SCgdxjD.exe
  C:\Windows\System\SCgdxjD.exe
  2⤵
  PID:10148
- C:\Windows\System\twYlOjZ.exe
  C:\Windows\System\twYlOjZ.exe
  2⤵
  PID:10164
- C:\Windows\System\UUKYBCc.exe
  C:\Windows\System\UUKYBCc.exe
  2⤵
  PID:10180
- C:\Windows\System\dAnvxya.exe
  C:\Windows\System\dAnvxya.exe
  2⤵
  PID:10196
- C:\Windows\System\iQCleOV.exe
  C:\Windows\System\iQCleOV.exe
  2⤵
  PID:10212
- C:\Windows\System\wGSsvjn.exe
  C:\Windows\System\wGSsvjn.exe
  2⤵
  PID:10228
- C:\Windows\System\EXmrSaT.exe
  C:\Windows\System\EXmrSaT.exe
  2⤵
  PID:9232
- C:\Windows\System\BtcEDFl.exe
  C:\Windows\System\BtcEDFl.exe
  2⤵
  PID:9264
- C:\Windows\System\bjUQBuS.exe
  C:\Windows\System\bjUQBuS.exe
  2⤵
  PID:8640
- C:\Windows\System\xhVeyTL.exe
  C:\Windows\System\xhVeyTL.exe
  2⤵
  PID:8868
- C:\Windows\System\RbWjMnn.exe
  C:\Windows\System\RbWjMnn.exe
  2⤵
  PID:9248
- C:\Windows\System\hWnFdqz.exe
  C:\Windows\System\hWnFdqz.exe
  2⤵
  PID:9168
- C:\Windows\System\DoaFokY.exe
  C:\Windows\System\DoaFokY.exe
  2⤵
  PID:9360
- C:\Windows\System\nQQVtff.exe
  C:\Windows\System\nQQVtff.exe
  2⤵
  PID:9340
- C:\Windows\System\FlCAwGF.exe
  C:\Windows\System\FlCAwGF.exe
  2⤵
  PID:9308
- C:\Windows\System\Nqprlys.exe
  C:\Windows\System\Nqprlys.exe
  2⤵
  PID:9312
- C:\Windows\System\jkUXgCi.exe
  C:\Windows\System\jkUXgCi.exe
  2⤵
  PID:9456
- C:\Windows\System\TznTvps.exe
  C:\Windows\System\TznTvps.exe
  2⤵
  PID:9516
- C:\Windows\System\scaeWyh.exe
  C:\Windows\System\scaeWyh.exe
  2⤵
  PID:9504
- C:\Windows\System\stBzpXI.exe
  C:\Windows\System\stBzpXI.exe
  2⤵
  PID:9536
- C:\Windows\System\wYFPleW.exe
  C:\Windows\System\wYFPleW.exe
  2⤵
  PID:9584
- C:\Windows\System\fLJMvMX.exe
  C:\Windows\System\fLJMvMX.exe
  2⤵
  PID:9612
- C:\Windows\System\ESkkdBU.exe
  C:\Windows\System\ESkkdBU.exe
  2⤵
  PID:9628
- C:\Windows\System\ftIhSjT.exe
  C:\Windows\System\ftIhSjT.exe
  2⤵
  PID:9644
- C:\Windows\System\CKvWZUr.exe
  C:\Windows\System\CKvWZUr.exe
  2⤵
  PID:9660
- C:\Windows\System\JluQnfs.exe
  C:\Windows\System\JluQnfs.exe
  2⤵
  PID:9708
- C:\Windows\System\UPSniGD.exe
  C:\Windows\System\UPSniGD.exe
  2⤵
  PID:9692
- C:\Windows\System\odMzvGZ.exe
  C:\Windows\System\odMzvGZ.exe
  2⤵
  PID:9776
- C:\Windows\System\mJUNgse.exe
  C:\Windows\System\mJUNgse.exe
  2⤵
  PID:9880
- C:\Windows\System\JrlEuEL.exe
  C:\Windows\System\JrlEuEL.exe
  2⤵
  PID:9932
- C:\Windows\System\xAIhHAk.exe
  C:\Windows\System\xAIhHAk.exe
  2⤵
  PID:9948
- C:\Windows\System\oSvRJxP.exe
  C:\Windows\System\oSvRJxP.exe
  2⤵
  PID:10044
- C:\Windows\System\SpJqdOj.exe
  C:\Windows\System\SpJqdOj.exe
  2⤵
  PID:10080
- C:\Windows\System\tAfBlji.exe
  C:\Windows\System\tAfBlji.exe
  2⤵
  PID:9968
- C:\Windows\System\FxVqBMK.exe
  C:\Windows\System\FxVqBMK.exe
  2⤵
  PID:10028
- C:\Windows\System\dIgcGFi.exe
  C:\Windows\System\dIgcGFi.exe
  2⤵
  PID:10140
- C:\Windows\System\hqnGxoU.exe
  C:\Windows\System\hqnGxoU.exe
  2⤵
  PID:10160
- C:\Windows\System\ynOWWXK.exe
  C:\Windows\System\ynOWWXK.exe
  2⤵
  PID:10224
- C:\Windows\System\XTvyOlR.exe
  C:\Windows\System\XTvyOlR.exe
  2⤵
  PID:8704
- C:\Windows\System\BfcKRKc.exe
  C:\Windows\System\BfcKRKc.exe
  2⤵
  PID:9328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BJIeXPC.exe

Filesize
1.7MB

MD5
1329717c7fedaa7154631a7c785a9702

SHA1
b32e5448bdf7c4cd6cd7fe144eb30edd444588ea

SHA256
bdf046c06b718ff3856982eea3405c0a8c54842793b7bc57a7c464eb5519196e

SHA512
183b3702ea1f7f42c2de83bc80e27ccb9618ccdb2d7b16b57cf55d8e37220fb558558dfde2f43ddc0a89dad97675f444fa18ab79af8867f4bd4223b8ae7a2f79

Download Submit
C:\Windows\system\BkfqXuO.exe

Filesize
1.7MB

MD5
2b3d75d02bb3f05178d295add629f6c9

SHA1
1ea1f21ddb708ae08e1c4ebe8d3b10551cf4dcbe

SHA256
1ac2bb75b81b84e28974c3a93b9cee494cc16e2334d5fcae35e18d8341806430

SHA512
6b39e17164423e1751455e93aa6dab35583306e2f361ee73a8036c226b39081a69bc0ea7d43c48a555facff93430276ebc33b89a10123f170f082e929a3c8c89

Download Submit
C:\Windows\system\EvzvgAO.exe

Filesize
1.7MB

MD5
2bff79b44d9b6b07ab3243bc054a2461

SHA1
fcad21f5b12e0fd645a8a0da39e05a6fc26419e4

SHA256
1484b9270788d69df3f1bf4b1036664c2b37dce6addf82d346c382b79956ab6d

SHA512
c4a4639749835a61b787d16093c5ed5d0a3dfe3e2ccc79cc9cf592f8847777f2fa362c184420406a52f17920f6d7a05c45a1fea7ed2d8267b0649cbbadb09f8e

Download Submit
C:\Windows\system\GNoQUTF.exe

Filesize
1.7MB

MD5
fe0f3a886eff41306472f38c5824e67a

SHA1
5238b7eb104ec40d3c6d980243571247ef13f0eb

SHA256
f87dca896c9fc1e9472adbd14f908b2fdf7353018dd0866ae5d4f2a9d8e7def7

SHA512
9a548c59d48a8553d4f673d9b50cbfc8b215581b8fcb0adf765c9fe314a414a6d8c9c486fe8569ca3c4ef0fd60701dd120047fcaafcfda6ba6286a7e998f396a

Download Submit
C:\Windows\system\HbCCKbX.exe

Filesize
1.7MB

MD5
d87c3b4147784cf616efd08e59af8e2c

SHA1
18420bd4a316c5a7dcf1455355d76d2c30b4ff55

SHA256
53b42fd0e50479d8fea1dd813b32b5575827c633ed0e1f2c262b9dc0edb5991d

SHA512
ebc80f3d71e0af01006f693bbdcf6994e66dcb666604b637bc60c2f3bfccb85d4c21fcbda58a885d9bf0c1f86471096c3882c0727eb2f92235503f563f0c68f3

Download Submit
C:\Windows\system\JHGDyvQ.exe

Filesize
1.7MB

MD5
cf6c1eeb1f7d023ff96e23f42b2ac862

SHA1
48f6e61b7ae9b471bf949d58d05c4255670fbf16

SHA256
bac0e647d31090ab9c4829d272ccbaef71e6cf2bbad24b95b62a0b3b439c9e5b

SHA512
93d5cd47d2180293e7cd3bb7dd0aff663f0288d6c53514840fd358915fb96d51f1900d1469ca14e768c918a0803c80c285345b2cb6462e504cb5a1f27f40096c

Download Submit
C:\Windows\system\JfmdGVQ.exe

Filesize
1.7MB

MD5
db8217992e95ed9fd71c47f0747e0628

SHA1
25fbe240af9c8e225163f440295f4781d000f891

SHA256
8908228f6275e1d19ea1eb021e36085e5d312293a9bca712f1dfaa71b73efa41

SHA512
1522a454ab02959b8566842788dc394e81dba39f6ecd2acd53247e7fd80ad34d1ca941fa806ec2e91aa858daf7ff0860d14b9f3be4fcd1f310fb613f6d3960fd

Download Submit
C:\Windows\system\JsCkvOp.exe

Filesize
1.7MB

MD5
73f97ffabf012c7b09bf90b826aa3071

SHA1
75cb6884faa39c9bff92f60174293ee42fa9f0ca

SHA256
578cc6cf1a679a20a2284d5068706455ec890e4f542cadad4d70ec926441ade5

SHA512
7c6d0c5ddd51261b490f86937c651b327d5e2b8afc6ddbc822f750e60c71f3acc9c05b190a151dafc3dbc01ecb82624a1dc7f99a26319f810f2914bd623a37ba

Download Submit
C:\Windows\system\KndNaiV.exe

Filesize
1.7MB

MD5
9c0629a21693a517c2f2a8568769f7e0

SHA1
230e4df68f1a6faf7884f91d94220b79da598f58

SHA256
cdba6a9a585bebcda8829dfd9fdbb06b157ae4996b96505c0342687e100a1a75

SHA512
d3dc39e9c9e356f1603ef5f11ab0d574a856516dfe4eaff1f56e04da1f7d48d310abf271f777431bfcf79894eadfa8b949978590be3732412253a85e87ab3d45

Download Submit
C:\Windows\system\KzvdJir.exe

Filesize
1.7MB

MD5
eb90c4f035ee712a6ee3567b57f0c188

SHA1
011afb77abd9bb3039cba31e8bf62b7d1d9346b0

SHA256
8c2d2260f6b9af7bb6e3b33d82dac10e921bc3d30bb7e1e10d157f55f1d367b2

SHA512
340641d67feec70e6025252381488e02c916023700437470c48d342ed5c30e96b60dd23f90512e84cc71ba2cb43cfa8ff4bab092e16df6849d95d6165be96328

Download Submit
C:\Windows\system\OvzLEzq.exe

Filesize
1.7MB

MD5
483699aa8e37fc20f4ce0c68f0fc6be2

SHA1
8868f5d78de68989064b6f950571f5689481739f

SHA256
b190a5392347f5d6be3fae80052fe8a4b3f3fd5471b376161f0cf61dd820032c

SHA512
c35b7dac02c0f90d370369888d7448a165ef0224d6b0f8d1024228bab2f82309dc07ae5755b6fc4288abfef92dadf92a0c63e2273d0693f7b97eb4a5db4b6379

Download Submit
C:\Windows\system\SgyprKt.exe

Filesize
1.7MB

MD5
a513b225d1420375727305ca04e9756f

SHA1
842833cbc55476fe70e6220ead6266720157324e

SHA256
9ada8e4a98e2f39a90b4d51d7f0c981010cba48929af011ee0f15da33ac90421

SHA512
7f70af1bfcb0bec17c2ed3e66d4a5adb7bd1a5ba267045abb3f3d5472e50ff7ca071cbabaa15866a723da186c715d9ff50fc2041b67a7d4b3c3af50ab5ce02e8

Download Submit
C:\Windows\system\XJdQThp.exe

Filesize
1.7MB

MD5
939e7d15f8e2aca43f05a7108a3e5c07

SHA1
a97eb2043f7ef7a480f660e168cad40c6361a19b

SHA256
ed48eb816f220ec52cb014c83a93d5c7611c67c76905f3a74d216c8ff7a745ab

SHA512
27ded69baa6a19c4821e55fb0a476f8595b3bdf665db97568eb0207150e12156ee40da7942a14c078a9528a623812177e92232c8562761e41af2bdb78e1ba777

Download Submit
C:\Windows\system\ZKgLJoj.exe

Filesize
1.7MB

MD5
bc0741503cb078b9b9fac70131dc2b61

SHA1
cd37bc2f85b03ea84b40cefb8349bb1d2b73de22

SHA256
36ca9d8ca23142848f560ff653436d251817e7043761a3b3fe63e5c36302f854

SHA512
83cbfb3a61393d106ae998931b75b802c0eba48d16a47e29903038d1cd2d17fae53102315ef3a3f02928b0a7b19d4051662672e721964f0831fb9bd3167b1813

Download Submit
C:\Windows\system\ZVTrOGw.exe

Filesize
1.7MB

MD5
faca30d23447b8ea643dffaa4e618000

SHA1
74a5dd6c086ed9c0571c29c6dc75fe51e7215563

SHA256
8c9b024b3983176278b874a71361c72043cc3459a5836d5752df6ad0af75fbf4

SHA512
b59ee173119ce29ab608ee5431e0566dde8b9b6b2008af24774cf365d9812f055bf476a4805b22a8eef30543b224626d84bc3a399ca3e193acc0e082853532b3

Download Submit
C:\Windows\system\ZoOebmC.exe

Filesize
1.7MB

MD5
658ff3009ca44594883fd94196404c9c

SHA1
9cdf838dfd37747bec799e0b6567c1f017feda64

SHA256
ba4828adc1ace1d75f256da9ed7d2556a74ad799ba317b7da71b03666bd4319f

SHA512
c845f4ade8bf4cb7ad87857f5cdee1bb21fa360f585435e18a2dbb36a9090aabf84a07df5bc5851d16f59d941ac998001a3af82c05c8a0d490710743333bfea2

Download Submit
C:\Windows\system\aBXOERE.exe

Filesize
1.7MB

MD5
2cab2038fb454e01633bff81b69e09bc

SHA1
47e771777edccafd12903e00efe62fd1b029c248

SHA256
c5129a16f3755914d2419224eee2d1a452ec160ec7ff9654c5ca90b69d227d64

SHA512
0d957d21ec90d2b01eb69d393f2951d72083a69f6d51afbc944c6290e9bc5aa4f522d02bd749192b30e9d15b4562922aeaebf873bd44447ba7e809200cba4933

Download Submit
C:\Windows\system\akupQAc.exe

Filesize
1.7MB

MD5
45b17933e2b2be6aef8fcbab6dfc9572

SHA1
bd1b678927570f11664769ce9d385a9365d893c2

SHA256
e414fb1e9ce7ba7f22f99875bbc47a15c0b7ca9f98b668a981e311944f0a8793

SHA512
0309835bfaabef15f10e7084b0d54a790386a126ae25cf885aa39b2c362d1b24a50d5db342065f56de5ba970e56348c10d553fafcd9ad6094108a2c51c3795a1

Download Submit
C:\Windows\system\eNYpmsB.exe

Filesize
1.7MB

MD5
dd7c8afa5fbba26334e014d733fa01b7

SHA1
a4dd1269e4ce39859fe280a7f7eb9488d50c8451

SHA256
2bb300b8333b1e70c0c985309cff77206b6bd17cea44cef850caa3c0ac54db44

SHA512
bad1607c00ec996c81a330df008628df75f80dd332368f6e4485f644c0056c97d89471b7b1d3ab13ac722bcd000afa378d918436487c95b0f2aedae5e078181d

Download Submit
C:\Windows\system\jqxJEAA.exe

Filesize
1.7MB

MD5
886ae031bcc7a8868f92e46d1b862abe

SHA1
e07b4dbd68b5b1c34e54e0ed07eb68c3772988aa

SHA256
6c83811a4808c6807179a4741fe5446883c47c024a3bd61f30838f1b788c90f3

SHA512
7e8b686e65b035864948559c66b78c22c8a07a0afd22f164c3174882768d17cf7238728378b3ca869144db07f35fb7cd2e427863fe8cb10bd1847a000274ae2d

Download Submit
C:\Windows\system\qBAFrGp.exe

Filesize
1.7MB

MD5
7c0d024420ec70ff1d8edfe60a43ebea

SHA1
4f5bcecd85894aeddd34491906bc0eff0eafa529

SHA256
d87ff69cb4bd7e0b293ac919ba7a39edc1a302c9719fc69a73c829890f33d0bc

SHA512
865d745adf49cb56d756bc9c754add45ae6600a4f4a8f44dc25a70ce7d67899f2c96961b3097c55fe1bba48be3faee8f1a34713b26a2bd020a0b9168b20871b0

Download Submit
C:\Windows\system\qFXBYxC.exe

Filesize
1.7MB

MD5
3568da6d2d7992a60ee0dc0d4dc95e08

SHA1
95be6a15c17cb597780c9bffff1b18b22a919558

SHA256
49c4ac9c5e5a43a71bd765755b321ef4675b678c50a395f6aafef263a694cca0

SHA512
c109ac4802683509d92faed6d0f3d944c6947efdd383a6c7d89a98e976458eed64d864993cb74e04c5d3d0b7cb2c8d2be0db7c99cf7d1e5c5534dc10d5a222b3

Download Submit
C:\Windows\system\tgaVnCP.exe

Filesize
1.7MB

MD5
b31eea875b378a08351b23ddf5c7e513

SHA1
5770148c32c82f8f5c87a373b7dd9e7eb5105082

SHA256
38b928aa1d8aa7db69c3eb55446f81889fb58d3541f0f808cfc4e42fa20508e7

SHA512
b2108405c36b5bf733efb443e61a4ccc06b3264a1b91e5271d9d1e64ddafecd474a444431089d15d4305f3fae02a2c956b42f27531cf60c0779824ba77608c03

Download Submit
C:\Windows\system\zfLXNCZ.exe

Filesize
1.7MB

MD5
c3428c58917ee01cb35da8b984faf126

SHA1
7d21667554b5a3357a02fb436eb9acffed7761fb

SHA256
2cef610690a0b9291b0fdc069008b2d6deb6ecd3ce8046ea8682d837d968eb49

SHA512
b1c86b796ae39f680a138105979e381d74f87ef3ae3883304d5bab7ce62c44081334571875b59d7a2ff30c9462e3096cdb869b6dea1efbecd53e36f9709fc6b9

Download Submit
\Windows\system\BGCoRVT.exe

Filesize
1.7MB

MD5
b206395477ca01caa20f86f19bbf22e1

SHA1
15cb14c87859773d7f1d74ddbf7375b2b2575fa1

SHA256
143fc07984889fea722bccf7bda8427abeededb961e4240b730df697f899acd6

SHA512
b31b11939931b219c3a63c0c994942846f598cade06243fd8728f3ad72ab1d67c4630dac55e1e12034491d3bc7935bc493150afc4df1747f6cf1f9563cdef705

Download Submit
\Windows\system\EYfErSo.exe

Filesize
1.7MB

MD5
28a891ebf057020ba5cde4effd19b623

SHA1
72db2f2624a13748de060005cc6e105e83aed001

SHA256
32c0276487782a394e2391206cbffa09797c807b681677314360cd3a52c38891

SHA512
6cf6f72e856331526cd7040d2d49cd6a995f43e1ada2549ec8a08edd7845125b0fb7e7f843e44c8f0271d1078606b166a3d1bba0f32deb8880112bdfc1b7026e

Download Submit
\Windows\system\FDeDCXe.exe

Filesize
1.7MB

MD5
cf8d17bcebbbc5fbd6a7df49a6799ecc

SHA1
44b2d5abed748f120447c815619c4d7ac3f908d9

SHA256
61b97962199121a490ecab932b408720cf32d678fbc395cc144cc7ed6bbcd9ab

SHA512
365a23cc8f42f6e14a1edb1aa528c19f6ea5fe145f82bcbe1a6f534ede811246ba5ff98e741a0c6eb0451fd4f09b586fccbc9428cb7f69c1b62e22ee6eda47bc

Download Submit
\Windows\system\LyNiJxe.exe

Filesize
1.7MB

MD5
28f01dafc358a452ed5acee95c757f4b

SHA1
d87c2af35fc18967a3367c1887d9e1a3231e1556

SHA256
8400a51e4293d2742c776d838b2a3523b0be169108c5ccfcfcc265445eef1a64

SHA512
2f5c38110572111c0ebd73546911229a663f1c9815dd6893fa2460d6c85e01b4d3db6001ee567e28503cf14bf4e2138758bf67918b6da2b5dcb952240edef6f1

Download Submit
\Windows\system\OkbbYrU.exe

Filesize
1.7MB

MD5
f91753b306f14105a0ff55386e319c8b

SHA1
ebe7f07dbbfa04603ddd2a4f66d628f9b047b76a

SHA256
a75c33c75ea12b97dc2b160e7b9c11a02cef536a5e87f01474907ee80b0dc0d3

SHA512
8dc3a21c8f989300aa0794d6ba46d1d88f5b989a7152085ee10318828eb70007add6ed1ffeb9f2832b898a065ec946b539ed1562e26387f72524eca529cd6b93

Download Submit
\Windows\system\RkaXmZQ.exe

Filesize
1.7MB

MD5
37c7dbca7e28782a8e54ffd5b6d1492c

SHA1
2f12631d01ecf5295c0ec47898ce58d87f6629d9

SHA256
6d8e89aba87ea87a05bbc8dba4b245ab46c7b5b87a65ebe9e7caa3bf91c3f1fb

SHA512
180030b495d56aec089485753b5a9d0162fbb2c535528629253a7eb719483bf781ecfadc69d775930bfba53d2f532f5a4c6619befcf36c14f540fa39f437584d

Download Submit
\Windows\system\ctedPmx.exe

Filesize
1.7MB

MD5
4e91f7efe7f5a278424afc17db9101b1

SHA1
3e4f8ac939a15bdbc725537f26a1d61a7679def6

SHA256
54674a6efb58d586ca592865a62961de4c74475f62a3ee7e18be53b0c16ce030

SHA512
d7b0cfa5786abce5df6642854b96a97a30ad84ff77d5d5edcbf91533ec9c6751cbdd1c922e04254df9120ed9a123a6280c1821358cf202523cfeccc8ca846f47

Download Submit
\Windows\system\uMePNDT.exe

Filesize
1.7MB

MD5
5934a41ad2468b0ba6694e9957404de7

SHA1
772bc170861825740afcf7131257ff2e1ac28f09

SHA256
404a7a5ef32fa6e9d76e6119149605929c89cacefbdeb52b2adf5ae141f6f1c8

SHA512
daff94ba20580bc5d1335a535f579ad5bb1b0dde06d80ea6f0693c2385ee819cd71c9fc8f2263d311b894f7661f30542f3739cd65c033f398719d0a5b57e59fa

Download Submit
\Windows\system\vkRuycX.exe

Filesize
1.7MB

MD5
f57939e914fc475f31229294779fa402

SHA1
83928d11e5bfd401d998c10654626119bfb1fd26

SHA256
0c31c80e5387a635b995c13d7e33a05eb134291754ce9ad0bc5cca18dce6b5ae

SHA512
cdebd6b72d8e8c0d465f500c3a0e81140f08adc944d911bcc7658eb0c47f8872f780ebdb455dc167b2d5950c5294b8595b0969bf0939a877860ca63fd986db96

Download Submit
memory/1724-172-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

Filesize
9.6MB

Download
memory/1724-285-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/1724-496-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

Filesize
9.6MB

Download
memory/1724-288-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/1724-21-0x000007FEF616E000-0x000007FEF616F000-memory.dmp

Filesize
4KB

Download
memory/1924-199-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1924-200-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1924-185-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/1924-175-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1924-7575-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1924-173-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-187-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1924-6328-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/1924-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1924-7-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-202-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1924-201-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/1924-1-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/1924-18-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/1924-207-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1924-191-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/1940-5087-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/1940-180-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2144-4958-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2144-204-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2396-194-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2396-4951-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2436-205-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2436-4956-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2556-188-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-4953-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-174-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-4895-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-208-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-4961-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-20-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2768-186-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2904-4964-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2904-203-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2908-4959-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2908-206-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2916-8-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download