xmrig | 32330a0543d91d97e1f599dc49450aea23989c5f0d549ea30c5d903b1ca94a1c

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
Size

2.1MB
MD5

228c570fd2cd4cc6295cc1d395ba3765
SHA1

2046c882a61ce16ca3e5c6eeb2805c215fa7349a
SHA256

32330a0543d91d97e1f599dc49450aea23989c5f0d549ea30c5d903b1ca94a1c
SHA512

95eac896dbc170b0295b2f895e09814eb881a9c5f2b99e5948b367ab787f40e29dde775ae3d707bd1fd5638383f15c534a1fae504b7e3e708c0fe9fb3eb3756d
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM42:NABx

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2568-63-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2808-84-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/3028-79-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2948-54-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2656-95-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2764-91-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2688-69-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2728-40-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/1956-4692-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2568-6706-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2808-6705-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2688-6708-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2728-6707-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/3028-6729-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2656-6726-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2948-6725-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2764-6723-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2460-7385-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2456	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1956	muJjsIi.exe
2728	LVARyKx.exe
2764	irEAiBT.exe
2948	rHEbbMp.exe
2568	KAFZSZz.exe
2688	xzOQDBa.exe
2656	ZRZAWuz.exe
3028	NhKiBHK.exe
2808	lgLHXER.exe
1592	FCelPzX.exe
1636	CmwhyiV.exe
2816	damGbBI.exe
1544	ULWuBhr.exe
2804	DIgFFCS.exe
2552	jaHKkcU.exe
1304	ZiSUaEm.exe
2300	rAswcAz.exe
2308	GkSszJq.exe
2600	iqVIvMt.exe
1928	fsdBjvU.exe
1664	qhJEwkB.exe
2892	urxoQon.exe
1536	JUnSFNx.exe
2336	tYdbzEw.exe
2508	MPkRtGt.exe
844	SzYHYqT.exe
2572	yVvJHBE.exe
2064	HocZZmc.exe
1492	PfKLjRb.exe
2956	QudJVkH.exe
704	BzlIFMd.exe
308	YmaRPEN.exe
1012	QeBYUmw.exe
856	ZQHflJL.exe
776	bYbGocT.exe
2264	DJDBvaN.exe
1340	AUGePGf.exe
1936	vrUrYfo.exe
1568	TvDTTks.exe
1004	nSDPbsH.exe
2072	ZiIsixV.exe
1676	txDAzMR.exe
112	METjWqL.exe
568	qfpMWtb.exe
1976	dKJDqPZ.exe
1128	nlDreHI.exe
2008	gYiErUx.exe
2172	gdrgMKX.exe
2296	iOXgdbr.exe
3000	XyXFjby.exe
2620	VfFTNEb.exe
1804	fHNkZyZ.exe
2992	abAYUyt.exe
2940	xJhlsES.exe
1588	RnuRtGV.exe
1616	OoXvfFX.exe
2740	EVqcHIt.exe
2824	idikXtB.exe
2712	cMAVaCr.exe
2220	GIdQiaO.exe
3040	mhuaoeg.exe
2900	FzlBwKg.exe
1728	IXNcKAV.exe
1516	rJfTBoT.exe

Loads dropped DLL 64 IoCs

pid	Process
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2460-2-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/files/0x000d000000012279-6.dat	upx
behavioral1/memory/1956-8-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/files/0x0008000000014317-16.dat	upx
behavioral1/memory/2568-63-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2808-84-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/files/0x0006000000015ca9-163.dat	upx
behavioral1/files/0x0006000000015d28-181.dat	upx
behavioral1/files/0x0006000000015fbb-187.dat	upx
behavioral1/files/0x0006000000015d13-174.dat	upx
behavioral1/files/0x0006000000015cf5-172.dat	upx
behavioral1/files/0x0006000000015ce1-170.dat	upx
behavioral1/files/0x0006000000015cca-167.dat	upx
behavioral1/files/0x0006000000015d99-164.dat	upx
behavioral1/files/0x000700000001543a-150.dat	upx
behavioral1/files/0x0006000000015ced-129.dat	upx
behavioral1/files/0x00080000000150aa-124.dat	upx
behavioral1/files/0x000700000001448b-106.dat	upx
behavioral1/files/0x0006000000015bb5-89.dat	upx
behavioral1/files/0x0006000000015c91-86.dat	upx
behavioral1/memory/3028-79-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/files/0x0006000000015b72-76.dat	upx
behavioral1/files/0x0006000000015a15-58.dat	upx
behavioral1/memory/2948-54-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/files/0x0006000000015f40-178.dat	upx
behavioral1/files/0x0006000000015d89-153.dat	upx
behavioral1/files/0x0006000000015d1e-144.dat	upx
behavioral1/files/0x0006000000015d02-134.dat	upx
behavioral1/files/0x0006000000015cd8-116.dat	upx
behavioral1/files/0x0006000000015cc2-110.dat	upx
behavioral1/files/0x0006000000015c9b-99.dat	upx
behavioral1/memory/2656-95-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2764-91-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2688-69-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/files/0x0006000000015b37-68.dat	upx
behavioral1/files/0x00060000000155e8-67.dat	upx
behavioral1/files/0x00130000000054a8-66.dat	upx
behavioral1/memory/2728-40-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x00070000000144d6-33.dat	upx
behavioral1/files/0x0007000000014430-32.dat	upx
behavioral1/files/0x0008000000014254-31.dat	upx
behavioral1/files/0x00350000000141aa-19.dat	upx
behavioral1/memory/1956-4692-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2568-6706-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2808-6705-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2688-6708-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2728-6707-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/3028-6729-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2656-6726-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2948-6725-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2764-6723-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2460-7385-0x000000013F940000-0x000000013FD32000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iGBearR.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\ZhIezgd.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\kNpxAfs.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\JYvatYU.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\CYkMbZb.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\qPRUHoC.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\LsnimWS.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\qPrZtOc.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\hJfuibc.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\htvOVmH.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\rqCbsfc.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\pxFOBQI.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\RgLCYNX.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\kFhFSHi.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\XyUgyAA.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\WEXPwtv.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\pdtRXct.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\bwHvCRa.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\EWzSdAa.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\GkSszJq.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\LBDTiAZ.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\KECAjTt.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\IxNGgMB.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\CFGnEqx.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\XkkMCDm.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\ciAJVam.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\fVFyqjs.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\MIkJBVE.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\FKWYmyg.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\ewnMygQ.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\tAznILl.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\InCcCYt.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\bkkvXHR.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\qGPvEbR.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\LdxXcdc.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\HJqptmq.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\NuUTgUe.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\ihmQnoT.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\WocgOke.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\igDxdXP.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\JyMHLKH.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\uhKtSHz.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\jzuVUGc.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\PtsSWWL.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\QImEDzu.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\yAazzsG.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\dsOCMcM.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\Qopepar.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\ancCtTy.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\bbpNsSn.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\Ucuwmkf.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\NtbVyiW.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\WfdYZaK.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\RMGTWNV.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\dXPRQXJ.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\jUeevbj.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\KFGCAfH.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\SbVYuDe.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\gxqyXrc.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\hzLfkoF.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\COgBLdz.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\DESUNat.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\VgQAIxb.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
File created	C:\Windows\System\QdLcYGl.exe	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2456	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
Token: SeDebugPrivilege	2456	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2456	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	29
PID 2460 wrote to memory of 2456	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	29
PID 2460 wrote to memory of 2456	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	29
PID 2460 wrote to memory of 1956	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	30
PID 2460 wrote to memory of 1956	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	30
PID 2460 wrote to memory of 1956	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	30
PID 2460 wrote to memory of 2728	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2728	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2728	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2764	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	32
PID 2460 wrote to memory of 2764	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	32
PID 2460 wrote to memory of 2764	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	32
PID 2460 wrote to memory of 2688	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	33
PID 2460 wrote to memory of 2688	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	33
PID 2460 wrote to memory of 2688	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	33
PID 2460 wrote to memory of 2948	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	34
PID 2460 wrote to memory of 2948	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	34
PID 2460 wrote to memory of 2948	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	34
PID 2460 wrote to memory of 2816	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	35
PID 2460 wrote to memory of 2816	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	35
PID 2460 wrote to memory of 2816	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	35
PID 2460 wrote to memory of 2568	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	36
PID 2460 wrote to memory of 2568	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	36
PID 2460 wrote to memory of 2568	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	36
PID 2460 wrote to memory of 2552	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	37
PID 2460 wrote to memory of 2552	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	37
PID 2460 wrote to memory of 2552	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	37
PID 2460 wrote to memory of 2656	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	38
PID 2460 wrote to memory of 2656	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	38
PID 2460 wrote to memory of 2656	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	38
PID 2460 wrote to memory of 2600	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	39
PID 2460 wrote to memory of 2600	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	39
PID 2460 wrote to memory of 2600	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	39
PID 2460 wrote to memory of 3028	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	40
PID 2460 wrote to memory of 3028	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	40
PID 2460 wrote to memory of 3028	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	40
PID 2460 wrote to memory of 1664	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	41
PID 2460 wrote to memory of 1664	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	41
PID 2460 wrote to memory of 1664	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	41
PID 2460 wrote to memory of 2808	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	42
PID 2460 wrote to memory of 2808	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	42
PID 2460 wrote to memory of 2808	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	42
PID 2460 wrote to memory of 2892	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	43
PID 2460 wrote to memory of 2892	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	43
PID 2460 wrote to memory of 2892	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	43
PID 2460 wrote to memory of 1592	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	44
PID 2460 wrote to memory of 1592	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	44
PID 2460 wrote to memory of 1592	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	44
PID 2460 wrote to memory of 1536	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	45
PID 2460 wrote to memory of 1536	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	45
PID 2460 wrote to memory of 1536	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	45
PID 2460 wrote to memory of 1636	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	46
PID 2460 wrote to memory of 1636	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	46
PID 2460 wrote to memory of 1636	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	46
PID 2460 wrote to memory of 2336	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	47
PID 2460 wrote to memory of 2336	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	47
PID 2460 wrote to memory of 2336	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	47
PID 2460 wrote to memory of 1544	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	48
PID 2460 wrote to memory of 1544	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	48
PID 2460 wrote to memory of 1544	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	48
PID 2460 wrote to memory of 2508	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	49
PID 2460 wrote to memory of 2508	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	49
PID 2460 wrote to memory of 2508	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	49
PID 2460 wrote to memory of 2804	2460	228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\228c570fd2cd4cc6295cc1d395ba3765_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\System\muJjsIi.exe
  C:\Windows\System\muJjsIi.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\LVARyKx.exe
  C:\Windows\System\LVARyKx.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\irEAiBT.exe
  C:\Windows\System\irEAiBT.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\xzOQDBa.exe
  C:\Windows\System\xzOQDBa.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\rHEbbMp.exe
  C:\Windows\System\rHEbbMp.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\damGbBI.exe
  C:\Windows\System\damGbBI.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\KAFZSZz.exe
  C:\Windows\System\KAFZSZz.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\jaHKkcU.exe
  C:\Windows\System\jaHKkcU.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ZRZAWuz.exe
  C:\Windows\System\ZRZAWuz.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\iqVIvMt.exe
  C:\Windows\System\iqVIvMt.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\NhKiBHK.exe
  C:\Windows\System\NhKiBHK.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\qhJEwkB.exe
  C:\Windows\System\qhJEwkB.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\lgLHXER.exe
  C:\Windows\System\lgLHXER.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\urxoQon.exe
  C:\Windows\System\urxoQon.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\FCelPzX.exe
  C:\Windows\System\FCelPzX.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\JUnSFNx.exe
  C:\Windows\System\JUnSFNx.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\CmwhyiV.exe
  C:\Windows\System\CmwhyiV.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\tYdbzEw.exe
  C:\Windows\System\tYdbzEw.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\ULWuBhr.exe
  C:\Windows\System\ULWuBhr.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\MPkRtGt.exe
  C:\Windows\System\MPkRtGt.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\DIgFFCS.exe
  C:\Windows\System\DIgFFCS.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\SzYHYqT.exe
  C:\Windows\System\SzYHYqT.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\ZiSUaEm.exe
  C:\Windows\System\ZiSUaEm.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\yVvJHBE.exe
  C:\Windows\System\yVvJHBE.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\rAswcAz.exe
  C:\Windows\System\rAswcAz.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\HocZZmc.exe
  C:\Windows\System\HocZZmc.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\GkSszJq.exe
  C:\Windows\System\GkSszJq.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\QudJVkH.exe
  C:\Windows\System\QudJVkH.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\fsdBjvU.exe
  C:\Windows\System\fsdBjvU.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\BzlIFMd.exe
  C:\Windows\System\BzlIFMd.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\PfKLjRb.exe
  C:\Windows\System\PfKLjRb.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\YmaRPEN.exe
  C:\Windows\System\YmaRPEN.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\QeBYUmw.exe
  C:\Windows\System\QeBYUmw.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\ZQHflJL.exe
  C:\Windows\System\ZQHflJL.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\bYbGocT.exe
  C:\Windows\System\bYbGocT.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\DJDBvaN.exe
  C:\Windows\System\DJDBvaN.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\AUGePGf.exe
  C:\Windows\System\AUGePGf.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\TvDTTks.exe
  C:\Windows\System\TvDTTks.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\vrUrYfo.exe
  C:\Windows\System\vrUrYfo.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\nSDPbsH.exe
  C:\Windows\System\nSDPbsH.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\ZiIsixV.exe
  C:\Windows\System\ZiIsixV.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\txDAzMR.exe
  C:\Windows\System\txDAzMR.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\METjWqL.exe
  C:\Windows\System\METjWqL.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\qfpMWtb.exe
  C:\Windows\System\qfpMWtb.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\dKJDqPZ.exe
  C:\Windows\System\dKJDqPZ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\nlDreHI.exe
  C:\Windows\System\nlDreHI.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\gYiErUx.exe
  C:\Windows\System\gYiErUx.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\gdrgMKX.exe
  C:\Windows\System\gdrgMKX.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\iOXgdbr.exe
  C:\Windows\System\iOXgdbr.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\XyXFjby.exe
  C:\Windows\System\XyXFjby.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\VfFTNEb.exe
  C:\Windows\System\VfFTNEb.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\fHNkZyZ.exe
  C:\Windows\System\fHNkZyZ.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\abAYUyt.exe
  C:\Windows\System\abAYUyt.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\xJhlsES.exe
  C:\Windows\System\xJhlsES.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\RnuRtGV.exe
  C:\Windows\System\RnuRtGV.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\OoXvfFX.exe
  C:\Windows\System\OoXvfFX.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\EVqcHIt.exe
  C:\Windows\System\EVqcHIt.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\idikXtB.exe
  C:\Windows\System\idikXtB.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\cMAVaCr.exe
  C:\Windows\System\cMAVaCr.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\GIdQiaO.exe
  C:\Windows\System\GIdQiaO.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\mhuaoeg.exe
  C:\Windows\System\mhuaoeg.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\FzlBwKg.exe
  C:\Windows\System\FzlBwKg.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\IXNcKAV.exe
  C:\Windows\System\IXNcKAV.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\rJfTBoT.exe
  C:\Windows\System\rJfTBoT.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\BNAVDTj.exe
  C:\Windows\System\BNAVDTj.exe
  2⤵
  PID:1404
- C:\Windows\System\HSWnvxX.exe
  C:\Windows\System\HSWnvxX.exe
  2⤵
  PID:2012
- C:\Windows\System\MeebZzP.exe
  C:\Windows\System\MeebZzP.exe
  2⤵
  PID:604
- C:\Windows\System\TnAJHak.exe
  C:\Windows\System\TnAJHak.exe
  2⤵
  PID:540
- C:\Windows\System\YDnCGDx.exe
  C:\Windows\System\YDnCGDx.exe
  2⤵
  PID:1744
- C:\Windows\System\EkZAPph.exe
  C:\Windows\System\EkZAPph.exe
  2⤵
  PID:2136
- C:\Windows\System\NFdtUeI.exe
  C:\Windows\System\NFdtUeI.exe
  2⤵
  PID:1528
- C:\Windows\System\hYyaIaR.exe
  C:\Windows\System\hYyaIaR.exe
  2⤵
  PID:1576
- C:\Windows\System\LTIlKvP.exe
  C:\Windows\System\LTIlKvP.exe
  2⤵
  PID:1560
- C:\Windows\System\wMTzwva.exe
  C:\Windows\System\wMTzwva.exe
  2⤵
  PID:1240
- C:\Windows\System\VZAClkf.exe
  C:\Windows\System\VZAClkf.exe
  2⤵
  PID:1948
- C:\Windows\System\EkQPumd.exe
  C:\Windows\System\EkQPumd.exe
  2⤵
  PID:1668
- C:\Windows\System\MvvemjZ.exe
  C:\Windows\System\MvvemjZ.exe
  2⤵
  PID:2268
- C:\Windows\System\XcjDkVS.exe
  C:\Windows\System\XcjDkVS.exe
  2⤵
  PID:1556
- C:\Windows\System\cRcSgUu.exe
  C:\Windows\System\cRcSgUu.exe
  2⤵
  PID:2084
- C:\Windows\System\LFpFfdK.exe
  C:\Windows\System\LFpFfdK.exe
  2⤵
  PID:976
- C:\Windows\System\JFYtKFD.exe
  C:\Windows\System\JFYtKFD.exe
  2⤵
  PID:340
- C:\Windows\System\upcUoJs.exe
  C:\Windows\System\upcUoJs.exe
  2⤵
  PID:808
- C:\Windows\System\IAHszrK.exe
  C:\Windows\System\IAHszrK.exe
  2⤵
  PID:1660
- C:\Windows\System\XtZFqgM.exe
  C:\Windows\System\XtZFqgM.exe
  2⤵
  PID:1068
- C:\Windows\System\UqYKYpD.exe
  C:\Windows\System\UqYKYpD.exe
  2⤵
  PID:1160
- C:\Windows\System\NmkWICZ.exe
  C:\Windows\System\NmkWICZ.exe
  2⤵
  PID:2272
- C:\Windows\System\JlYadDh.exe
  C:\Windows\System\JlYadDh.exe
  2⤵
  PID:892
- C:\Windows\System\MeYlsqj.exe
  C:\Windows\System\MeYlsqj.exe
  2⤵
  PID:1200
- C:\Windows\System\mdszhpO.exe
  C:\Windows\System\mdszhpO.exe
  2⤵
  PID:2464
- C:\Windows\System\WXENLHN.exe
  C:\Windows\System\WXENLHN.exe
  2⤵
  PID:2664
- C:\Windows\System\zwjCNsh.exe
  C:\Windows\System\zwjCNsh.exe
  2⤵
  PID:2440
- C:\Windows\System\SDeKALW.exe
  C:\Windows\System\SDeKALW.exe
  2⤵
  PID:2876
- C:\Windows\System\mnKoroC.exe
  C:\Windows\System\mnKoroC.exe
  2⤵
  PID:2848
- C:\Windows\System\CGgtiyO.exe
  C:\Windows\System\CGgtiyO.exe
  2⤵
  PID:2200
- C:\Windows\System\SzQBUaz.exe
  C:\Windows\System\SzQBUaz.exe
  2⤵
  PID:688
- C:\Windows\System\hqBPiUm.exe
  C:\Windows\System\hqBPiUm.exe
  2⤵
  PID:824
- C:\Windows\System\hskXVqu.exe
  C:\Windows\System\hskXVqu.exe
  2⤵
  PID:1256
- C:\Windows\System\UqlZFfD.exe
  C:\Windows\System\UqlZFfD.exe
  2⤵
  PID:2968
- C:\Windows\System\HcdfDAM.exe
  C:\Windows\System\HcdfDAM.exe
  2⤵
  PID:2852
- C:\Windows\System\pxFOBQI.exe
  C:\Windows\System\pxFOBQI.exe
  2⤵
  PID:848
- C:\Windows\System\ifQMkcf.exe
  C:\Windows\System\ifQMkcf.exe
  2⤵
  PID:2352
- C:\Windows\System\cFmmJNO.exe
  C:\Windows\System\cFmmJNO.exe
  2⤵
  PID:3084
- C:\Windows\System\gOeifQQ.exe
  C:\Windows\System\gOeifQQ.exe
  2⤵
  PID:3108
- C:\Windows\System\whAFbwO.exe
  C:\Windows\System\whAFbwO.exe
  2⤵
  PID:3124
- C:\Windows\System\mSNHKcs.exe
  C:\Windows\System\mSNHKcs.exe
  2⤵
  PID:3148
- C:\Windows\System\znMuFXi.exe
  C:\Windows\System\znMuFXi.exe
  2⤵
  PID:3168
- C:\Windows\System\cDtoPGP.exe
  C:\Windows\System\cDtoPGP.exe
  2⤵
  PID:3184
- C:\Windows\System\bFyRYOS.exe
  C:\Windows\System\bFyRYOS.exe
  2⤵
  PID:3200
- C:\Windows\System\uTxbRor.exe
  C:\Windows\System\uTxbRor.exe
  2⤵
  PID:3216
- C:\Windows\System\zQbVaTl.exe
  C:\Windows\System\zQbVaTl.exe
  2⤵
  PID:3232
- C:\Windows\System\hLrtSCp.exe
  C:\Windows\System\hLrtSCp.exe
  2⤵
  PID:3248
- C:\Windows\System\jhVrIdT.exe
  C:\Windows\System\jhVrIdT.exe
  2⤵
  PID:3272
- C:\Windows\System\eujwzHW.exe
  C:\Windows\System\eujwzHW.exe
  2⤵
  PID:3296
- C:\Windows\System\moQcIzg.exe
  C:\Windows\System\moQcIzg.exe
  2⤵
  PID:3312
- C:\Windows\System\DRfeGFU.exe
  C:\Windows\System\DRfeGFU.exe
  2⤵
  PID:3328
- C:\Windows\System\TaGkZqQ.exe
  C:\Windows\System\TaGkZqQ.exe
  2⤵
  PID:3348
- C:\Windows\System\HJqptmq.exe
  C:\Windows\System\HJqptmq.exe
  2⤵
  PID:3420
- C:\Windows\System\RtlZGNZ.exe
  C:\Windows\System\RtlZGNZ.exe
  2⤵
  PID:3440
- C:\Windows\System\MgaahvP.exe
  C:\Windows\System\MgaahvP.exe
  2⤵
  PID:3456
- C:\Windows\System\ePlhMcg.exe
  C:\Windows\System\ePlhMcg.exe
  2⤵
  PID:3472
- C:\Windows\System\GAdehUL.exe
  C:\Windows\System\GAdehUL.exe
  2⤵
  PID:3500
- C:\Windows\System\lHtzyKR.exe
  C:\Windows\System\lHtzyKR.exe
  2⤵
  PID:3520
- C:\Windows\System\SIwahVi.exe
  C:\Windows\System\SIwahVi.exe
  2⤵
  PID:3540
- C:\Windows\System\LMgUivP.exe
  C:\Windows\System\LMgUivP.exe
  2⤵
  PID:3560
- C:\Windows\System\vJsCbyQ.exe
  C:\Windows\System\vJsCbyQ.exe
  2⤵
  PID:3580
- C:\Windows\System\GlyRprM.exe
  C:\Windows\System\GlyRprM.exe
  2⤵
  PID:3600
- C:\Windows\System\QvvqZSq.exe
  C:\Windows\System\QvvqZSq.exe
  2⤵
  PID:3620
- C:\Windows\System\FIRZVcB.exe
  C:\Windows\System\FIRZVcB.exe
  2⤵
  PID:3640
- C:\Windows\System\rLPBWcl.exe
  C:\Windows\System\rLPBWcl.exe
  2⤵
  PID:3660
- C:\Windows\System\hFZDTBt.exe
  C:\Windows\System\hFZDTBt.exe
  2⤵
  PID:3676
- C:\Windows\System\irhGDOm.exe
  C:\Windows\System\irhGDOm.exe
  2⤵
  PID:3696
- C:\Windows\System\DXmzfRV.exe
  C:\Windows\System\DXmzfRV.exe
  2⤵
  PID:3712
- C:\Windows\System\qdsXUJF.exe
  C:\Windows\System\qdsXUJF.exe
  2⤵
  PID:3736
- C:\Windows\System\KaYDroj.exe
  C:\Windows\System\KaYDroj.exe
  2⤵
  PID:3752
- C:\Windows\System\WqZKfqv.exe
  C:\Windows\System\WqZKfqv.exe
  2⤵
  PID:3772
- C:\Windows\System\PgcRbdC.exe
  C:\Windows\System\PgcRbdC.exe
  2⤵
  PID:3788
- C:\Windows\System\EumLbGF.exe
  C:\Windows\System\EumLbGF.exe
  2⤵
  PID:3804
- C:\Windows\System\ipOBDBI.exe
  C:\Windows\System\ipOBDBI.exe
  2⤵
  PID:3824
- C:\Windows\System\uThevZn.exe
  C:\Windows\System\uThevZn.exe
  2⤵
  PID:3860
- C:\Windows\System\QISKNmu.exe
  C:\Windows\System\QISKNmu.exe
  2⤵
  PID:3880
- C:\Windows\System\fhoPHTN.exe
  C:\Windows\System\fhoPHTN.exe
  2⤵
  PID:3896
- C:\Windows\System\euUMMwS.exe
  C:\Windows\System\euUMMwS.exe
  2⤵
  PID:3912
- C:\Windows\System\OwFXicW.exe
  C:\Windows\System\OwFXicW.exe
  2⤵
  PID:3936
- C:\Windows\System\yoyUxYa.exe
  C:\Windows\System\yoyUxYa.exe
  2⤵
  PID:3956
- C:\Windows\System\PtsSWWL.exe
  C:\Windows\System\PtsSWWL.exe
  2⤵
  PID:3972
- C:\Windows\System\brhYNvP.exe
  C:\Windows\System\brhYNvP.exe
  2⤵
  PID:3988
- C:\Windows\System\gSFEIql.exe
  C:\Windows\System\gSFEIql.exe
  2⤵
  PID:4004
- C:\Windows\System\oYaGVZL.exe
  C:\Windows\System\oYaGVZL.exe
  2⤵
  PID:4020
- C:\Windows\System\WnenmYz.exe
  C:\Windows\System\WnenmYz.exe
  2⤵
  PID:4040
- C:\Windows\System\SJXrxwA.exe
  C:\Windows\System\SJXrxwA.exe
  2⤵
  PID:4056
- C:\Windows\System\agiWxri.exe
  C:\Windows\System\agiWxri.exe
  2⤵
  PID:4072
- C:\Windows\System\TOLYXPK.exe
  C:\Windows\System\TOLYXPK.exe
  2⤵
  PID:4088
- C:\Windows\System\PCYXbZa.exe
  C:\Windows\System\PCYXbZa.exe
  2⤵
  PID:1652
- C:\Windows\System\RhpgAxV.exe
  C:\Windows\System\RhpgAxV.exe
  2⤵
  PID:1392
- C:\Windows\System\tPiHxoJ.exe
  C:\Windows\System\tPiHxoJ.exe
  2⤵
  PID:1500
- C:\Windows\System\LdLzDDJ.exe
  C:\Windows\System\LdLzDDJ.exe
  2⤵
  PID:1032
- C:\Windows\System\SYMBxuY.exe
  C:\Windows\System\SYMBxuY.exe
  2⤵
  PID:408
- C:\Windows\System\SKfYfBl.exe
  C:\Windows\System\SKfYfBl.exe
  2⤵
  PID:1608
- C:\Windows\System\MraLixt.exe
  C:\Windows\System\MraLixt.exe
  2⤵
  PID:3060
- C:\Windows\System\jrlJjwf.exe
  C:\Windows\System\jrlJjwf.exe
  2⤵
  PID:2584
- C:\Windows\System\UjzDjJZ.exe
  C:\Windows\System\UjzDjJZ.exe
  2⤵
  PID:3160
- C:\Windows\System\InacgVz.exe
  C:\Windows\System\InacgVz.exe
  2⤵
  PID:2164
- C:\Windows\System\QyNwccR.exe
  C:\Windows\System\QyNwccR.exe
  2⤵
  PID:2952
- C:\Windows\System\GZfcwoG.exe
  C:\Windows\System\GZfcwoG.exe
  2⤵
  PID:2244
- C:\Windows\System\BgUNbeP.exe
  C:\Windows\System\BgUNbeP.exe
  2⤵
  PID:3224
- C:\Windows\System\DAZhEpR.exe
  C:\Windows\System\DAZhEpR.exe
  2⤵
  PID:3268
- C:\Windows\System\ZdnuGTd.exe
  C:\Windows\System\ZdnuGTd.exe
  2⤵
  PID:3308
- C:\Windows\System\oKiKtxd.exe
  C:\Windows\System\oKiKtxd.exe
  2⤵
  PID:3340
- C:\Windows\System\OjlEryk.exe
  C:\Windows\System\OjlEryk.exe
  2⤵
  PID:2792
- C:\Windows\System\JvaYBeo.exe
  C:\Windows\System\JvaYBeo.exe
  2⤵
  PID:3104
- C:\Windows\System\tconfjv.exe
  C:\Windows\System\tconfjv.exe
  2⤵
  PID:2364
- C:\Windows\System\mOWXfxy.exe
  C:\Windows\System\mOWXfxy.exe
  2⤵
  PID:3212
- C:\Windows\System\UiPuCeA.exe
  C:\Windows\System\UiPuCeA.exe
  2⤵
  PID:3292
- C:\Windows\System\WYdYGZZ.exe
  C:\Windows\System\WYdYGZZ.exe
  2⤵
  PID:3360
- C:\Windows\System\ATQAmKi.exe
  C:\Windows\System\ATQAmKi.exe
  2⤵
  PID:3380
- C:\Windows\System\avgBXAb.exe
  C:\Windows\System\avgBXAb.exe
  2⤵
  PID:3396
- C:\Windows\System\FaTCBVO.exe
  C:\Windows\System\FaTCBVO.exe
  2⤵
  PID:3416
- C:\Windows\System\CUeSEPy.exe
  C:\Windows\System\CUeSEPy.exe
  2⤵
  PID:3464
- C:\Windows\System\qNGwWVt.exe
  C:\Windows\System\qNGwWVt.exe
  2⤵
  PID:3480
- C:\Windows\System\yNrStoJ.exe
  C:\Windows\System\yNrStoJ.exe
  2⤵
  PID:3484
- C:\Windows\System\YguIkpn.exe
  C:\Windows\System\YguIkpn.exe
  2⤵
  PID:3532
- C:\Windows\System\IMUStYV.exe
  C:\Windows\System\IMUStYV.exe
  2⤵
  PID:3596
- C:\Windows\System\dlegRfX.exe
  C:\Windows\System\dlegRfX.exe
  2⤵
  PID:3628
- C:\Windows\System\PHFGfTA.exe
  C:\Windows\System\PHFGfTA.exe
  2⤵
  PID:3616
- C:\Windows\System\yXSUzbW.exe
  C:\Windows\System\yXSUzbW.exe
  2⤵
  PID:3668
- C:\Windows\System\UspaMol.exe
  C:\Windows\System\UspaMol.exe
  2⤵
  PID:2820
- C:\Windows\System\kupHWVx.exe
  C:\Windows\System\kupHWVx.exe
  2⤵
  PID:3812
- C:\Windows\System\TTyUCbp.exe
  C:\Windows\System\TTyUCbp.exe
  2⤵
  PID:3872
- C:\Windows\System\lYjZthn.exe
  C:\Windows\System\lYjZthn.exe
  2⤵
  PID:3656
- C:\Windows\System\pGnqzpK.exe
  C:\Windows\System\pGnqzpK.exe
  2⤵
  PID:3944
- C:\Windows\System\irlhmSc.exe
  C:\Windows\System\irlhmSc.exe
  2⤵
  PID:2112
- C:\Windows\System\XYJWrpN.exe
  C:\Windows\System\XYJWrpN.exe
  2⤵
  PID:2368
- C:\Windows\System\MKayDgJ.exe
  C:\Windows\System\MKayDgJ.exe
  2⤵
  PID:3036
- C:\Windows\System\LHfvtJi.exe
  C:\Windows\System\LHfvtJi.exe
  2⤵
  PID:3764
- C:\Windows\System\NbiIEYc.exe
  C:\Windows\System\NbiIEYc.exe
  2⤵
  PID:2056
- C:\Windows\System\BPAqQCT.exe
  C:\Windows\System\BPAqQCT.exe
  2⤵
  PID:3836
- C:\Windows\System\VFvsNnA.exe
  C:\Windows\System\VFvsNnA.exe
  2⤵
  PID:3848
- C:\Windows\System\adWYMIv.exe
  C:\Windows\System\adWYMIv.exe
  2⤵
  PID:3892
- C:\Windows\System\KXNlfkb.exe
  C:\Windows\System\KXNlfkb.exe
  2⤵
  PID:3996
- C:\Windows\System\imecwEn.exe
  C:\Windows\System\imecwEn.exe
  2⤵
  PID:4068
- C:\Windows\System\fxAioCh.exe
  C:\Windows\System\fxAioCh.exe
  2⤵
  PID:1960
- C:\Windows\System\hQjSYIh.exe
  C:\Windows\System\hQjSYIh.exe
  2⤵
  PID:2260
- C:\Windows\System\TTuJZqf.exe
  C:\Windows\System\TTuJZqf.exe
  2⤵
  PID:2856
- C:\Windows\System\WYJHoVZ.exe
  C:\Windows\System\WYJHoVZ.exe
  2⤵
  PID:1552
- C:\Windows\System\TtGogSt.exe
  C:\Windows\System\TtGogSt.exe
  2⤵
  PID:3048
- C:\Windows\System\UPQldpw.exe
  C:\Windows\System\UPQldpw.exe
  2⤵
  PID:560
- C:\Windows\System\uTpecBA.exe
  C:\Windows\System\uTpecBA.exe
  2⤵
  PID:1156
- C:\Windows\System\KhcCBDa.exe
  C:\Windows\System\KhcCBDa.exe
  2⤵
  PID:3260
- C:\Windows\System\TkLsuJI.exe
  C:\Windows\System\TkLsuJI.exe
  2⤵
  PID:3180
- C:\Windows\System\VgQAIxb.exe
  C:\Windows\System\VgQAIxb.exe
  2⤵
  PID:2000
- C:\Windows\System\ebCcbIM.exe
  C:\Windows\System\ebCcbIM.exe
  2⤵
  PID:3432
- C:\Windows\System\VzaQXnN.exe
  C:\Windows\System\VzaQXnN.exe
  2⤵
  PID:3508
- C:\Windows\System\QFRmiQY.exe
  C:\Windows\System\QFRmiQY.exe
  2⤵
  PID:3588
- C:\Windows\System\OlfQOAx.exe
  C:\Windows\System\OlfQOAx.exe
  2⤵
  PID:3820
- C:\Windows\System\XvnHGmJ.exe
  C:\Windows\System\XvnHGmJ.exe
  2⤵
  PID:1796
- C:\Windows\System\ibrnxgQ.exe
  C:\Windows\System\ibrnxgQ.exe
  2⤵
  PID:2104
- C:\Windows\System\jrkhlOc.exe
  C:\Windows\System\jrkhlOc.exe
  2⤵
  PID:3372
- C:\Windows\System\ZQFCTjx.exe
  C:\Windows\System\ZQFCTjx.exe
  2⤵
  PID:3732
- C:\Windows\System\ncGbQgT.exe
  C:\Windows\System\ncGbQgT.exe
  2⤵
  PID:2772
- C:\Windows\System\WzrDMGr.exe
  C:\Windows\System\WzrDMGr.exe
  2⤵
  PID:3888
- C:\Windows\System\eAUuaMp.exe
  C:\Windows\System\eAUuaMp.exe
  2⤵
  PID:4032
- C:\Windows\System\Rluspje.exe
  C:\Windows\System\Rluspje.exe
  2⤵
  PID:2724
- C:\Windows\System\UQADcOI.exe
  C:\Windows\System\UQADcOI.exe
  2⤵
  PID:2556
- C:\Windows\System\FPQRvtU.exe
  C:\Windows\System\FPQRvtU.exe
  2⤵
  PID:1308
- C:\Windows\System\elpgWpG.exe
  C:\Windows\System\elpgWpG.exe
  2⤵
  PID:3612
- C:\Windows\System\sdgZuPm.exe
  C:\Windows\System\sdgZuPm.exe
  2⤵
  PID:3784
- C:\Windows\System\JyrHQRV.exe
  C:\Windows\System\JyrHQRV.exe
  2⤵
  PID:2068
- C:\Windows\System\WxIMnHM.exe
  C:\Windows\System\WxIMnHM.exe
  2⤵
  PID:1060
- C:\Windows\System\wLZdVZa.exe
  C:\Windows\System\wLZdVZa.exe
  2⤵
  PID:3984
- C:\Windows\System\kyvuLul.exe
  C:\Windows\System\kyvuLul.exe
  2⤵
  PID:4016
- C:\Windows\System\QkNPOgc.exe
  C:\Windows\System\QkNPOgc.exe
  2⤵
  PID:4052
- C:\Windows\System\CWKvaOj.exe
  C:\Windows\System\CWKvaOj.exe
  2⤵
  PID:3748
- C:\Windows\System\wMslBSr.exe
  C:\Windows\System\wMslBSr.exe
  2⤵
  PID:4080
- C:\Windows\System\ZtBdwBd.exe
  C:\Windows\System\ZtBdwBd.exe
  2⤵
  PID:3024
- C:\Windows\System\rDkCBET.exe
  C:\Windows\System\rDkCBET.exe
  2⤵
  PID:264
- C:\Windows\System\cQCGbuE.exe
  C:\Windows\System\cQCGbuE.exe
  2⤵
  PID:3056
- C:\Windows\System\eTmwxoW.exe
  C:\Windows\System\eTmwxoW.exe
  2⤵
  PID:1992
- C:\Windows\System\zskUkBG.exe
  C:\Windows\System\zskUkBG.exe
  2⤵
  PID:1868
- C:\Windows\System\OKorTBw.exe
  C:\Windows\System\OKorTBw.exe
  2⤵
  PID:3724
- C:\Windows\System\qXpWsUW.exe
  C:\Windows\System\qXpWsUW.exe
  2⤵
  PID:2608
- C:\Windows\System\WdWUMFt.exe
  C:\Windows\System\WdWUMFt.exe
  2⤵
  PID:3256
- C:\Windows\System\qiFPGvL.exe
  C:\Windows\System\qiFPGvL.exe
  2⤵
  PID:1432
- C:\Windows\System\WuLJxuG.exe
  C:\Windows\System\WuLJxuG.exe
  2⤵
  PID:3392
- C:\Windows\System\EwfUrrj.exe
  C:\Windows\System\EwfUrrj.exe
  2⤵
  PID:2540
- C:\Windows\System\zKoXaYv.exe
  C:\Windows\System\zKoXaYv.exe
  2⤵
  PID:3244
- C:\Windows\System\BXTQopf.exe
  C:\Windows\System\BXTQopf.exe
  2⤵
  PID:2224
- C:\Windows\System\ZOFfCEN.exe
  C:\Windows\System\ZOFfCEN.exe
  2⤵
  PID:3720
- C:\Windows\System\daieIWh.exe
  C:\Windows\System\daieIWh.exe
  2⤵
  PID:1964
- C:\Windows\System\hawEpTz.exe
  C:\Windows\System\hawEpTz.exe
  2⤵
  PID:2780
- C:\Windows\System\VWPspaR.exe
  C:\Windows\System\VWPspaR.exe
  2⤵
  PID:2624
- C:\Windows\System\vNYOqBM.exe
  C:\Windows\System\vNYOqBM.exe
  2⤵
  PID:2500
- C:\Windows\System\NLcOGJF.exe
  C:\Windows\System\NLcOGJF.exe
  2⤵
  PID:3368
- C:\Windows\System\sMQbBZW.exe
  C:\Windows\System\sMQbBZW.exe
  2⤵
  PID:3092
- C:\Windows\System\DgvtxOR.exe
  C:\Windows\System\DgvtxOR.exe
  2⤵
  PID:2140
- C:\Windows\System\YImyCQw.exe
  C:\Windows\System\YImyCQw.exe
  2⤵
  PID:2776
- C:\Windows\System\SfqSElW.exe
  C:\Windows\System\SfqSElW.exe
  2⤵
  PID:3952
- C:\Windows\System\ftgMYVj.exe
  C:\Windows\System\ftgMYVj.exe
  2⤵
  PID:4048
- C:\Windows\System\pmeWHCD.exe
  C:\Windows\System\pmeWHCD.exe
  2⤵
  PID:3692
- C:\Windows\System\RsEVTbz.exe
  C:\Windows\System\RsEVTbz.exe
  2⤵
  PID:1988
- C:\Windows\System\CntSlVe.exe
  C:\Windows\System\CntSlVe.exe
  2⤵
  PID:1736
- C:\Windows\System\NXfEMGv.exe
  C:\Windows\System\NXfEMGv.exe
  2⤵
  PID:1824
- C:\Windows\System\VbcxRPE.exe
  C:\Windows\System\VbcxRPE.exe
  2⤵
  PID:2872
- C:\Windows\System\EcMALBV.exe
  C:\Windows\System\EcMALBV.exe
  2⤵
  PID:2976
- C:\Windows\System\iiLuwnr.exe
  C:\Windows\System\iiLuwnr.exe
  2⤵
  PID:620
- C:\Windows\System\hUpCqSS.exe
  C:\Windows\System\hUpCqSS.exe
  2⤵
  PID:2504
- C:\Windows\System\gZJvYHW.exe
  C:\Windows\System\gZJvYHW.exe
  2⤵
  PID:768
- C:\Windows\System\dVOkFHX.exe
  C:\Windows\System\dVOkFHX.exe
  2⤵
  PID:1880
- C:\Windows\System\AQqVkRq.exe
  C:\Windows\System\AQqVkRq.exe
  2⤵
  PID:2412
- C:\Windows\System\ojCEHCQ.exe
  C:\Windows\System\ojCEHCQ.exe
  2⤵
  PID:1760
- C:\Windows\System\BRMYuQE.exe
  C:\Windows\System\BRMYuQE.exe
  2⤵
  PID:1056
- C:\Windows\System\VnBWvVT.exe
  C:\Windows\System\VnBWvVT.exe
  2⤵
  PID:3796
- C:\Windows\System\CxrbQWx.exe
  C:\Windows\System\CxrbQWx.exe
  2⤵
  PID:3800
- C:\Windows\System\mkmHnCU.exe
  C:\Windows\System\mkmHnCU.exe
  2⤵
  PID:4108
- C:\Windows\System\AXgGWPS.exe
  C:\Windows\System\AXgGWPS.exe
  2⤵
  PID:4128
- C:\Windows\System\naULhPi.exe
  C:\Windows\System\naULhPi.exe
  2⤵
  PID:4144
- C:\Windows\System\DWCHzAg.exe
  C:\Windows\System\DWCHzAg.exe
  2⤵
  PID:4160
- C:\Windows\System\OCxsVjY.exe
  C:\Windows\System\OCxsVjY.exe
  2⤵
  PID:4176
- C:\Windows\System\xMOLMvA.exe
  C:\Windows\System\xMOLMvA.exe
  2⤵
  PID:4192
- C:\Windows\System\qikgfWW.exe
  C:\Windows\System\qikgfWW.exe
  2⤵
  PID:4208
- C:\Windows\System\SvRUehK.exe
  C:\Windows\System\SvRUehK.exe
  2⤵
  PID:4228
- C:\Windows\System\SMnbEaw.exe
  C:\Windows\System\SMnbEaw.exe
  2⤵
  PID:4248
- C:\Windows\System\iCNftVV.exe
  C:\Windows\System\iCNftVV.exe
  2⤵
  PID:4264
- C:\Windows\System\LvEGdkq.exe
  C:\Windows\System\LvEGdkq.exe
  2⤵
  PID:4280
- C:\Windows\System\ARmbtTe.exe
  C:\Windows\System\ARmbtTe.exe
  2⤵
  PID:4296
- C:\Windows\System\jaiRqpa.exe
  C:\Windows\System\jaiRqpa.exe
  2⤵
  PID:4312
- C:\Windows\System\WhUhozE.exe
  C:\Windows\System\WhUhozE.exe
  2⤵
  PID:4328
- C:\Windows\System\CUVhDpN.exe
  C:\Windows\System\CUVhDpN.exe
  2⤵
  PID:4344
- C:\Windows\System\RxwJhZE.exe
  C:\Windows\System\RxwJhZE.exe
  2⤵
  PID:4364
- C:\Windows\System\rgDzJEF.exe
  C:\Windows\System\rgDzJEF.exe
  2⤵
  PID:4380
- C:\Windows\System\lCwlbNB.exe
  C:\Windows\System\lCwlbNB.exe
  2⤵
  PID:4396
- C:\Windows\System\LoGmjKt.exe
  C:\Windows\System\LoGmjKt.exe
  2⤵
  PID:4412
- C:\Windows\System\NxJUOjd.exe
  C:\Windows\System\NxJUOjd.exe
  2⤵
  PID:4472
- C:\Windows\System\gsYUefc.exe
  C:\Windows\System\gsYUefc.exe
  2⤵
  PID:4592
- C:\Windows\System\ZJRMHur.exe
  C:\Windows\System\ZJRMHur.exe
  2⤵
  PID:4640
- C:\Windows\System\CnRFSfp.exe
  C:\Windows\System\CnRFSfp.exe
  2⤵
  PID:4656
- C:\Windows\System\QjfmVQJ.exe
  C:\Windows\System\QjfmVQJ.exe
  2⤵
  PID:4672
- C:\Windows\System\lNTIrYX.exe
  C:\Windows\System\lNTIrYX.exe
  2⤵
  PID:4688
- C:\Windows\System\EtelhoJ.exe
  C:\Windows\System\EtelhoJ.exe
  2⤵
  PID:4708
- C:\Windows\System\tNPTexS.exe
  C:\Windows\System\tNPTexS.exe
  2⤵
  PID:4756
- C:\Windows\System\hOWPrRP.exe
  C:\Windows\System\hOWPrRP.exe
  2⤵
  PID:4808
- C:\Windows\System\pSfSUBL.exe
  C:\Windows\System\pSfSUBL.exe
  2⤵
  PID:4828
- C:\Windows\System\vzeZlXw.exe
  C:\Windows\System\vzeZlXw.exe
  2⤵
  PID:4844
- C:\Windows\System\WGgbcCh.exe
  C:\Windows\System\WGgbcCh.exe
  2⤵
  PID:4860
- C:\Windows\System\aajDEry.exe
  C:\Windows\System\aajDEry.exe
  2⤵
  PID:4880
- C:\Windows\System\HZJwLft.exe
  C:\Windows\System\HZJwLft.exe
  2⤵
  PID:4896
- C:\Windows\System\jSaTrTH.exe
  C:\Windows\System\jSaTrTH.exe
  2⤵
  PID:4912
- C:\Windows\System\iWeuOzS.exe
  C:\Windows\System\iWeuOzS.exe
  2⤵
  PID:4928
- C:\Windows\System\UrvQRlH.exe
  C:\Windows\System\UrvQRlH.exe
  2⤵
  PID:4944
- C:\Windows\System\itAdywi.exe
  C:\Windows\System\itAdywi.exe
  2⤵
  PID:4960
- C:\Windows\System\hvizQkr.exe
  C:\Windows\System\hvizQkr.exe
  2⤵
  PID:4976
- C:\Windows\System\DDcroUE.exe
  C:\Windows\System\DDcroUE.exe
  2⤵
  PID:4992
- C:\Windows\System\XrhlMlo.exe
  C:\Windows\System\XrhlMlo.exe
  2⤵
  PID:5008
- C:\Windows\System\TlRlJWJ.exe
  C:\Windows\System\TlRlJWJ.exe
  2⤵
  PID:5024
- C:\Windows\System\ePzIYUd.exe
  C:\Windows\System\ePzIYUd.exe
  2⤵
  PID:5040
- C:\Windows\System\enthZdW.exe
  C:\Windows\System\enthZdW.exe
  2⤵
  PID:5056
- C:\Windows\System\bzidDgD.exe
  C:\Windows\System\bzidDgD.exe
  2⤵
  PID:5100
- C:\Windows\System\TfyYoJh.exe
  C:\Windows\System\TfyYoJh.exe
  2⤵
  PID:5116
- C:\Windows\System\nyfEUhu.exe
  C:\Windows\System\nyfEUhu.exe
  2⤵
  PID:2592
- C:\Windows\System\cQfYIVu.exe
  C:\Windows\System\cQfYIVu.exe
  2⤵
  PID:3648
- C:\Windows\System\SIdZgVu.exe
  C:\Windows\System\SIdZgVu.exe
  2⤵
  PID:4028
- C:\Windows\System\ZImHZdj.exe
  C:\Windows\System\ZImHZdj.exe
  2⤵
  PID:2384
- C:\Windows\System\RQSIyyM.exe
  C:\Windows\System\RQSIyyM.exe
  2⤵
  PID:3452
- C:\Windows\System\BTJKRit.exe
  C:\Windows\System\BTJKRit.exe
  2⤵
  PID:2796
- C:\Windows\System\CvaLnrY.exe
  C:\Windows\System\CvaLnrY.exe
  2⤵
  PID:3356
- C:\Windows\System\ZTlKmUK.exe
  C:\Windows\System\ZTlKmUK.exe
  2⤵
  PID:1124
- C:\Windows\System\vqWfwIb.exe
  C:\Windows\System\vqWfwIb.exe
  2⤵
  PID:4116
- C:\Windows\System\VtiNEfl.exe
  C:\Windows\System\VtiNEfl.exe
  2⤵
  PID:4432
- C:\Windows\System\DBxTXjX.exe
  C:\Windows\System\DBxTXjX.exe
  2⤵
  PID:4448
- C:\Windows\System\hPaUwDN.exe
  C:\Windows\System\hPaUwDN.exe
  2⤵
  PID:2040
- C:\Windows\System\NYBafGC.exe
  C:\Windows\System\NYBafGC.exe
  2⤵
  PID:1864
- C:\Windows\System\ACXhfkC.exe
  C:\Windows\System\ACXhfkC.exe
  2⤵
  PID:1828
- C:\Windows\System\rIEQUvU.exe
  C:\Windows\System\rIEQUvU.exe
  2⤵
  PID:4352
- C:\Windows\System\qHoTciu.exe
  C:\Windows\System\qHoTciu.exe
  2⤵
  PID:4216
- C:\Windows\System\kDUkcei.exe
  C:\Windows\System\kDUkcei.exe
  2⤵
  PID:1296
- C:\Windows\System\PuRHODA.exe
  C:\Windows\System\PuRHODA.exe
  2⤵
  PID:4260
- C:\Windows\System\SmoLRiw.exe
  C:\Windows\System\SmoLRiw.exe
  2⤵
  PID:4188
- C:\Windows\System\IEJjZpU.exe
  C:\Windows\System\IEJjZpU.exe
  2⤵
  PID:2132
- C:\Windows\System\EpmsKWs.exe
  C:\Windows\System\EpmsKWs.exe
  2⤵
  PID:4372
- C:\Windows\System\qPrZtOc.exe
  C:\Windows\System\qPrZtOc.exe
  2⤵
  PID:4172
- C:\Windows\System\lKSEPHI.exe
  C:\Windows\System\lKSEPHI.exe
  2⤵
  PID:4496
- C:\Windows\System\pkoybTf.exe
  C:\Windows\System\pkoybTf.exe
  2⤵
  PID:4508
- C:\Windows\System\KYsyaDM.exe
  C:\Windows\System\KYsyaDM.exe
  2⤵
  PID:4536
- C:\Windows\System\ECsTlto.exe
  C:\Windows\System\ECsTlto.exe
  2⤵
  PID:4552
- C:\Windows\System\rZhdGSg.exe
  C:\Windows\System\rZhdGSg.exe
  2⤵
  PID:4572
- C:\Windows\System\bROzEMd.exe
  C:\Windows\System\bROzEMd.exe
  2⤵
  PID:4584
- C:\Windows\System\PWMbCzc.exe
  C:\Windows\System\PWMbCzc.exe
  2⤵
  PID:4608
- C:\Windows\System\ewnMygQ.exe
  C:\Windows\System\ewnMygQ.exe
  2⤵
  PID:4628
- C:\Windows\System\dLGciKe.exe
  C:\Windows\System\dLGciKe.exe
  2⤵
  PID:4720
- C:\Windows\System\NpZQwzT.exe
  C:\Windows\System\NpZQwzT.exe
  2⤵
  PID:4728
- C:\Windows\System\CVuTDFo.exe
  C:\Windows\System\CVuTDFo.exe
  2⤵
  PID:4724
- C:\Windows\System\slifzuz.exe
  C:\Windows\System\slifzuz.exe
  2⤵
  PID:4768
- C:\Windows\System\pNlYKSs.exe
  C:\Windows\System\pNlYKSs.exe
  2⤵
  PID:4788
- C:\Windows\System\mPpWNJF.exe
  C:\Windows\System\mPpWNJF.exe
  2⤵
  PID:4804
- C:\Windows\System\bkNpywf.exe
  C:\Windows\System\bkNpywf.exe
  2⤵
  PID:4824
- C:\Windows\System\ONnkMvJ.exe
  C:\Windows\System\ONnkMvJ.exe
  2⤵
  PID:4872
- C:\Windows\System\uKeyPBH.exe
  C:\Windows\System\uKeyPBH.exe
  2⤵
  PID:4888
- C:\Windows\System\UIFDVub.exe
  C:\Windows\System\UIFDVub.exe
  2⤵
  PID:4952
- C:\Windows\System\AvuvAAb.exe
  C:\Windows\System\AvuvAAb.exe
  2⤵
  PID:5076
- C:\Windows\System\aSKIHwI.exe
  C:\Windows\System\aSKIHwI.exe
  2⤵
  PID:4984
- C:\Windows\System\CvisPNL.exe
  C:\Windows\System\CvisPNL.exe
  2⤵
  PID:5004
- C:\Windows\System\VCSIiRR.exe
  C:\Windows\System\VCSIiRR.exe
  2⤵
  PID:4936
- C:\Windows\System\BPBUCPF.exe
  C:\Windows\System\BPBUCPF.exe
  2⤵
  PID:5096
- C:\Windows\System\ocrwiqR.exe
  C:\Windows\System\ocrwiqR.exe
  2⤵
  PID:5064
- C:\Windows\System\AItQHHw.exe
  C:\Windows\System\AItQHHw.exe
  2⤵
  PID:5036
- C:\Windows\System\ZXKeEPr.exe
  C:\Windows\System\ZXKeEPr.exe
  2⤵
  PID:3908
- C:\Windows\System\pbMEAEY.exe
  C:\Windows\System\pbMEAEY.exe
  2⤵
  PID:2276
- C:\Windows\System\dJoFKBH.exe
  C:\Windows\System\dJoFKBH.exe
  2⤵
  PID:2932
- C:\Windows\System\vyLqrLU.exe
  C:\Windows\System\vyLqrLU.exe
  2⤵
  PID:600
- C:\Windows\System\ZxnpIEi.exe
  C:\Windows\System\ZxnpIEi.exe
  2⤵
  PID:2284
- C:\Windows\System\FEROnwA.exe
  C:\Windows\System\FEROnwA.exe
  2⤵
  PID:2016
- C:\Windows\System\zAWNmQl.exe
  C:\Windows\System\zAWNmQl.exe
  2⤵
  PID:3548
- C:\Windows\System\CqflzNo.exe
  C:\Windows\System\CqflzNo.exe
  2⤵
  PID:3704
- C:\Windows\System\tjBnZAu.exe
  C:\Windows\System\tjBnZAu.exe
  2⤵
  PID:4452
- C:\Windows\System\ILxAlCU.exe
  C:\Windows\System\ILxAlCU.exe
  2⤵
  PID:2596
- C:\Windows\System\YpuJyat.exe
  C:\Windows\System\YpuJyat.exe
  2⤵
  PID:4428
- C:\Windows\System\mOBfDwM.exe
  C:\Windows\System\mOBfDwM.exe
  2⤵
  PID:4464
- C:\Windows\System\EsuEhTd.exe
  C:\Windows\System\EsuEhTd.exe
  2⤵
  PID:4140
- C:\Windows\System\HiUQKyU.exe
  C:\Windows\System\HiUQKyU.exe
  2⤵
  PID:4340
- C:\Windows\System\LATODxE.exe
  C:\Windows\System\LATODxE.exe
  2⤵
  PID:1248
- C:\Windows\System\WjrJpeX.exe
  C:\Windows\System\WjrJpeX.exe
  2⤵
  PID:1332
- C:\Windows\System\XQKdOdo.exe
  C:\Windows\System\XQKdOdo.exe
  2⤵
  PID:4236
- C:\Windows\System\SsThgyN.exe
  C:\Windows\System\SsThgyN.exe
  2⤵
  PID:2704
- C:\Windows\System\iBMqKbt.exe
  C:\Windows\System\iBMqKbt.exe
  2⤵
  PID:4308
- C:\Windows\System\qfJIOqu.exe
  C:\Windows\System\qfJIOqu.exe
  2⤵
  PID:4204
- C:\Windows\System\JDoTQXU.exe
  C:\Windows\System\JDoTQXU.exe
  2⤵
  PID:4520
- C:\Windows\System\tEYtZiU.exe
  C:\Windows\System\tEYtZiU.exe
  2⤵
  PID:4528
- C:\Windows\System\SFutStG.exe
  C:\Windows\System\SFutStG.exe
  2⤵
  PID:4568
- C:\Windows\System\MMmZauC.exe
  C:\Windows\System\MMmZauC.exe
  2⤵
  PID:4580
- C:\Windows\System\CCsEbfA.exe
  C:\Windows\System\CCsEbfA.exe
  2⤵
  PID:4600
- C:\Windows\System\TBvzbjs.exe
  C:\Windows\System\TBvzbjs.exe
  2⤵
  PID:4764
- C:\Windows\System\dCgKlHi.exe
  C:\Windows\System\dCgKlHi.exe
  2⤵
  PID:5092
- C:\Windows\System\rhRXhSm.exe
  C:\Windows\System\rhRXhSm.exe
  2⤵
  PID:2672
- C:\Windows\System\VTvafit.exe
  C:\Windows\System\VTvafit.exe
  2⤵
  PID:2912
- C:\Windows\System\xubdBlq.exe
  C:\Windows\System\xubdBlq.exe
  2⤵
  PID:4668
- C:\Windows\System\DEmyUtN.exe
  C:\Windows\System\DEmyUtN.exe
  2⤵
  PID:4700
- C:\Windows\System\OMFclos.exe
  C:\Windows\System\OMFclos.exe
  2⤵
  PID:3344
- C:\Windows\System\YmslgeF.exe
  C:\Windows\System\YmslgeF.exe
  2⤵
  PID:4288
- C:\Windows\System\ypUFfZZ.exe
  C:\Windows\System\ypUFfZZ.exe
  2⤵
  PID:4648
- C:\Windows\System\vqhBPPT.exe
  C:\Windows\System\vqhBPPT.exe
  2⤵
  PID:4780
- C:\Windows\System\MqXeBZr.exe
  C:\Windows\System\MqXeBZr.exe
  2⤵
  PID:4908
- C:\Windows\System\AoQprWj.exe
  C:\Windows\System\AoQprWj.exe
  2⤵
  PID:3144
- C:\Windows\System\YAeNNom.exe
  C:\Windows\System\YAeNNom.exe
  2⤵
  PID:2496
- C:\Windows\System\JakWwNa.exe
  C:\Windows\System\JakWwNa.exe
  2⤵
  PID:2840
- C:\Windows\System\lhtlQkz.exe
  C:\Windows\System\lhtlQkz.exe
  2⤵
  PID:4136
- C:\Windows\System\BpnzTfO.exe
  C:\Windows\System\BpnzTfO.exe
  2⤵
  PID:4548
- C:\Windows\System\GEbzBlS.exe
  C:\Windows\System\GEbzBlS.exe
  2⤵
  PID:4748
- C:\Windows\System\glBXrKH.exe
  C:\Windows\System\glBXrKH.exe
  2⤵
  PID:4324
- C:\Windows\System\ERKpcIJ.exe
  C:\Windows\System\ERKpcIJ.exe
  2⤵
  PID:4200
- C:\Windows\System\OGdkYHg.exe
  C:\Windows\System\OGdkYHg.exe
  2⤵
  PID:4512
- C:\Windows\System\tDsrxdD.exe
  C:\Windows\System\tDsrxdD.exe
  2⤵
  PID:1224
- C:\Windows\System\XfgdMZO.exe
  C:\Windows\System\XfgdMZO.exe
  2⤵
  PID:4444
- C:\Windows\System\sJJHYfk.exe
  C:\Windows\System\sJJHYfk.exe
  2⤵
  PID:3688
- C:\Windows\System\fXSaxhn.exe
  C:\Windows\System\fXSaxhn.exe
  2⤵
  PID:4404
- C:\Windows\System\tlPunVt.exe
  C:\Windows\System\tlPunVt.exe
  2⤵
  PID:4988
- C:\Windows\System\AJaWISY.exe
  C:\Windows\System\AJaWISY.exe
  2⤵
  PID:4744
- C:\Windows\System\JjwuqWH.exe
  C:\Windows\System\JjwuqWH.exe
  2⤵
  PID:4460
- C:\Windows\System\sKCjZjj.exe
  C:\Windows\System\sKCjZjj.exe
  2⤵
  PID:4664
- C:\Windows\System\JpAzjuC.exe
  C:\Windows\System\JpAzjuC.exe
  2⤵
  PID:4956
- C:\Windows\System\RUOFQMc.exe
  C:\Windows\System\RUOFQMc.exe
  2⤵
  PID:4556
- C:\Windows\System\pWytYSW.exe
  C:\Windows\System\pWytYSW.exe
  2⤵
  PID:4904
- C:\Windows\System\NdHwvNJ.exe
  C:\Windows\System\NdHwvNJ.exe
  2⤵
  PID:3760
- C:\Windows\System\hOoflQl.exe
  C:\Windows\System\hOoflQl.exe
  2⤵
  PID:4152
- C:\Windows\System\ZiiQxEA.exe
  C:\Windows\System\ZiiQxEA.exe
  2⤵
  PID:4492
- C:\Windows\System\yIHuEaM.exe
  C:\Windows\System\yIHuEaM.exe
  2⤵
  PID:4868
- C:\Windows\System\oIFZJLQ.exe
  C:\Windows\System\oIFZJLQ.exe
  2⤵
  PID:4440
- C:\Windows\System\SsyuESZ.exe
  C:\Windows\System\SsyuESZ.exe
  2⤵
  PID:4920
- C:\Windows\System\cKwMpEM.exe
  C:\Windows\System\cKwMpEM.exe
  2⤵
  PID:2720
- C:\Windows\System\GWMHVCj.exe
  C:\Windows\System\GWMHVCj.exe
  2⤵
  PID:5128
- C:\Windows\System\lbeSYiD.exe
  C:\Windows\System\lbeSYiD.exe
  2⤵
  PID:5144
- C:\Windows\System\CfZvvGe.exe
  C:\Windows\System\CfZvvGe.exe
  2⤵
  PID:5160
- C:\Windows\System\blfPIOq.exe
  C:\Windows\System\blfPIOq.exe
  2⤵
  PID:5176
- C:\Windows\System\thpVcSb.exe
  C:\Windows\System\thpVcSb.exe
  2⤵
  PID:5196
- C:\Windows\System\bJGXMme.exe
  C:\Windows\System\bJGXMme.exe
  2⤵
  PID:5212
- C:\Windows\System\EMtoNkw.exe
  C:\Windows\System\EMtoNkw.exe
  2⤵
  PID:5228
- C:\Windows\System\kVYEphR.exe
  C:\Windows\System\kVYEphR.exe
  2⤵
  PID:5244
- C:\Windows\System\kmuvmjj.exe
  C:\Windows\System\kmuvmjj.exe
  2⤵
  PID:5260
- C:\Windows\System\OXIXqsA.exe
  C:\Windows\System\OXIXqsA.exe
  2⤵
  PID:5280
- C:\Windows\System\FjvteBn.exe
  C:\Windows\System\FjvteBn.exe
  2⤵
  PID:5372
- C:\Windows\System\YyAfhKr.exe
  C:\Windows\System\YyAfhKr.exe
  2⤵
  PID:5388
- C:\Windows\System\NbbxUgL.exe
  C:\Windows\System\NbbxUgL.exe
  2⤵
  PID:5404
- C:\Windows\System\HHWvJan.exe
  C:\Windows\System\HHWvJan.exe
  2⤵
  PID:5420
- C:\Windows\System\hbjvSAn.exe
  C:\Windows\System\hbjvSAn.exe
  2⤵
  PID:5436
- C:\Windows\System\LavTnOZ.exe
  C:\Windows\System\LavTnOZ.exe
  2⤵
  PID:5452
- C:\Windows\System\FTICUbs.exe
  C:\Windows\System\FTICUbs.exe
  2⤵
  PID:5468
- C:\Windows\System\wHAMCBu.exe
  C:\Windows\System\wHAMCBu.exe
  2⤵
  PID:5484
- C:\Windows\System\cGKnsVh.exe
  C:\Windows\System\cGKnsVh.exe
  2⤵
  PID:5500
- C:\Windows\System\USwiUHK.exe
  C:\Windows\System\USwiUHK.exe
  2⤵
  PID:5516
- C:\Windows\System\KMXFrbF.exe
  C:\Windows\System\KMXFrbF.exe
  2⤵
  PID:5532
- C:\Windows\System\sKtwKbC.exe
  C:\Windows\System\sKtwKbC.exe
  2⤵
  PID:5548
- C:\Windows\System\tuktSHU.exe
  C:\Windows\System\tuktSHU.exe
  2⤵
  PID:5564
- C:\Windows\System\AJiTpAQ.exe
  C:\Windows\System\AJiTpAQ.exe
  2⤵
  PID:5580
- C:\Windows\System\RQaxpsT.exe
  C:\Windows\System\RQaxpsT.exe
  2⤵
  PID:5596
- C:\Windows\System\jmFKWmq.exe
  C:\Windows\System\jmFKWmq.exe
  2⤵
  PID:5612
- C:\Windows\System\qAQnegK.exe
  C:\Windows\System\qAQnegK.exe
  2⤵
  PID:5628
- C:\Windows\System\TguNXWx.exe
  C:\Windows\System\TguNXWx.exe
  2⤵
  PID:5644
- C:\Windows\System\VcaaJeh.exe
  C:\Windows\System\VcaaJeh.exe
  2⤵
  PID:5700
- C:\Windows\System\yCHyvMc.exe
  C:\Windows\System\yCHyvMc.exe
  2⤵
  PID:5716
- C:\Windows\System\vpWzNli.exe
  C:\Windows\System\vpWzNli.exe
  2⤵
  PID:5732
- C:\Windows\System\rtShASj.exe
  C:\Windows\System\rtShASj.exe
  2⤵
  PID:5748
- C:\Windows\System\fAqOzzh.exe
  C:\Windows\System\fAqOzzh.exe
  2⤵
  PID:5764
- C:\Windows\System\qKVGrez.exe
  C:\Windows\System\qKVGrez.exe
  2⤵
  PID:5780
- C:\Windows\System\vTrjuDx.exe
  C:\Windows\System\vTrjuDx.exe
  2⤵
  PID:5796
- C:\Windows\System\uGAIPxv.exe
  C:\Windows\System\uGAIPxv.exe
  2⤵
  PID:5812
- C:\Windows\System\qDjsHdp.exe
  C:\Windows\System\qDjsHdp.exe
  2⤵
  PID:5828
- C:\Windows\System\rkqnmWz.exe
  C:\Windows\System\rkqnmWz.exe
  2⤵
  PID:5844
- C:\Windows\System\oJzFnno.exe
  C:\Windows\System\oJzFnno.exe
  2⤵
  PID:5860
- C:\Windows\System\RDTKuEv.exe
  C:\Windows\System\RDTKuEv.exe
  2⤵
  PID:5876
- C:\Windows\System\vdgUFHj.exe
  C:\Windows\System\vdgUFHj.exe
  2⤵
  PID:5892
- C:\Windows\System\aQBDyPl.exe
  C:\Windows\System\aQBDyPl.exe
  2⤵
  PID:5908
- C:\Windows\System\VzQZZye.exe
  C:\Windows\System\VzQZZye.exe
  2⤵
  PID:5924
- C:\Windows\System\npUMrFY.exe
  C:\Windows\System\npUMrFY.exe
  2⤵
  PID:5940
- C:\Windows\System\xUdMktW.exe
  C:\Windows\System\xUdMktW.exe
  2⤵
  PID:5956
- C:\Windows\System\hMraBRR.exe
  C:\Windows\System\hMraBRR.exe
  2⤵
  PID:5972
- C:\Windows\System\svBCynG.exe
  C:\Windows\System\svBCynG.exe
  2⤵
  PID:5988
- C:\Windows\System\kUXJiZL.exe
  C:\Windows\System\kUXJiZL.exe
  2⤵
  PID:6004
- C:\Windows\System\FrjOXaA.exe
  C:\Windows\System\FrjOXaA.exe
  2⤵
  PID:6036
- C:\Windows\System\yPhTsID.exe
  C:\Windows\System\yPhTsID.exe
  2⤵
  PID:6052
- C:\Windows\System\GpELLPY.exe
  C:\Windows\System\GpELLPY.exe
  2⤵
  PID:6068
- C:\Windows\System\KSGHBYR.exe
  C:\Windows\System\KSGHBYR.exe
  2⤵
  PID:6084
- C:\Windows\System\ubRfMfK.exe
  C:\Windows\System\ubRfMfK.exe
  2⤵
  PID:6100
- C:\Windows\System\kdnlHoG.exe
  C:\Windows\System\kdnlHoG.exe
  2⤵
  PID:6116
- C:\Windows\System\IgRRAlX.exe
  C:\Windows\System\IgRRAlX.exe
  2⤵
  PID:6132
- C:\Windows\System\VoWdKdz.exe
  C:\Windows\System\VoWdKdz.exe
  2⤵
  PID:3576
- C:\Windows\System\onCtZFg.exe
  C:\Windows\System\onCtZFg.exe
  2⤵
  PID:5072
- C:\Windows\System\PEHtvoK.exe
  C:\Windows\System\PEHtvoK.exe
  2⤵
  PID:4336
- C:\Windows\System\JtwQOGw.exe
  C:\Windows\System\JtwQOGw.exe
  2⤵
  PID:4836
- C:\Windows\System\LBmuTVl.exe
  C:\Windows\System\LBmuTVl.exe
  2⤵
  PID:5124
- C:\Windows\System\GMdHvsZ.exe
  C:\Windows\System\GMdHvsZ.exe
  2⤵
  PID:5188
- C:\Windows\System\JNPntAx.exe
  C:\Windows\System\JNPntAx.exe
  2⤵
  PID:5172
- C:\Windows\System\YioYKJp.exe
  C:\Windows\System\YioYKJp.exe
  2⤵
  PID:5204
- C:\Windows\System\YePESda.exe
  C:\Windows\System\YePESda.exe
  2⤵
  PID:5288
- C:\Windows\System\mFWbzoH.exe
  C:\Windows\System\mFWbzoH.exe
  2⤵
  PID:5292
- C:\Windows\System\WwkpeIP.exe
  C:\Windows\System\WwkpeIP.exe
  2⤵
  PID:5208
- C:\Windows\System\iomUCTq.exe
  C:\Windows\System\iomUCTq.exe
  2⤵
  PID:5272
- C:\Windows\System\LVCTTJv.exe
  C:\Windows\System\LVCTTJv.exe
  2⤵
  PID:5328
- C:\Windows\System\XWMXcqd.exe
  C:\Windows\System\XWMXcqd.exe
  2⤵
  PID:5344
- C:\Windows\System\HlzKuXe.exe
  C:\Windows\System\HlzKuXe.exe
  2⤵
  PID:4736
- C:\Windows\System\vLbCWtI.exe
  C:\Windows\System\vLbCWtI.exe
  2⤵
  PID:5400
- C:\Windows\System\WjQCeis.exe
  C:\Windows\System\WjQCeis.exe
  2⤵
  PID:5464
- C:\Windows\System\MxNLOsA.exe
  C:\Windows\System\MxNLOsA.exe
  2⤵
  PID:5556
- C:\Windows\System\GlQKyIb.exe
  C:\Windows\System\GlQKyIb.exe
  2⤵
  PID:5620
- C:\Windows\System\ZioHkXn.exe
  C:\Windows\System\ZioHkXn.exe
  2⤵
  PID:5448
- C:\Windows\System\uMunEwf.exe
  C:\Windows\System\uMunEwf.exe
  2⤵
  PID:5416
- C:\Windows\System\dmvRcXy.exe
  C:\Windows\System\dmvRcXy.exe
  2⤵
  PID:5512
- C:\Windows\System\svCjyvK.exe
  C:\Windows\System\svCjyvK.exe
  2⤵
  PID:5576
- C:\Windows\System\QCTVBzZ.exe
  C:\Windows\System\QCTVBzZ.exe
  2⤵
  PID:5640
- C:\Windows\System\ZSknJKC.exe
  C:\Windows\System\ZSknJKC.exe
  2⤵
  PID:5664
- C:\Windows\System\CwEEbpy.exe
  C:\Windows\System\CwEEbpy.exe
  2⤵
  PID:5680
- C:\Windows\System\JcTHsFz.exe
  C:\Windows\System\JcTHsFz.exe
  2⤵
  PID:5712
- C:\Windows\System\hUhaMqr.exe
  C:\Windows\System\hUhaMqr.exe
  2⤵
  PID:5776
- C:\Windows\System\HvYXgWB.exe
  C:\Windows\System\HvYXgWB.exe
  2⤵
  PID:5840
- C:\Windows\System\cUnKDAA.exe
  C:\Windows\System\cUnKDAA.exe
  2⤵
  PID:5904
- C:\Windows\System\epFSWti.exe
  C:\Windows\System\epFSWti.exe
  2⤵
  PID:5968
- C:\Windows\System\OuWcZjs.exe
  C:\Windows\System\OuWcZjs.exe
  2⤵
  PID:5724
- C:\Windows\System\yTHtvjI.exe
  C:\Windows\System\yTHtvjI.exe
  2⤵
  PID:5788
- C:\Windows\System\JJORRcN.exe
  C:\Windows\System\JJORRcN.exe
  2⤵
  PID:5852
- C:\Windows\System\NpsCIZv.exe
  C:\Windows\System\NpsCIZv.exe
  2⤵
  PID:5916
- C:\Windows\System\AGZNaze.exe
  C:\Windows\System\AGZNaze.exe
  2⤵
  PID:5980
- C:\Windows\System\wiUFifp.exe
  C:\Windows\System\wiUFifp.exe
  2⤵
  PID:6024
- C:\Windows\System\bVWsHdE.exe
  C:\Windows\System\bVWsHdE.exe
  2⤵
  PID:6044
- C:\Windows\System\nJfOLfb.exe
  C:\Windows\System\nJfOLfb.exe
  2⤵
  PID:6108
- C:\Windows\System\lXDozot.exe
  C:\Windows\System\lXDozot.exe
  2⤵
  PID:5000
- C:\Windows\System\jAYUaYB.exe
  C:\Windows\System\jAYUaYB.exe
  2⤵
  PID:6064
- C:\Windows\System\DUOQpjQ.exe
  C:\Windows\System\DUOQpjQ.exe
  2⤵
  PID:5224
- C:\Windows\System\SBwKkeE.exe
  C:\Windows\System\SBwKkeE.exe
  2⤵
  PID:5192
- C:\Windows\System\mBSmSrw.exe
  C:\Windows\System\mBSmSrw.exe
  2⤵
  PID:5460
- C:\Windows\System\AWThZdh.exe
  C:\Windows\System\AWThZdh.exe
  2⤵
  PID:5412
- C:\Windows\System\wPJuNZr.exe
  C:\Windows\System\wPJuNZr.exe
  2⤵
  PID:5360
- C:\Windows\System\QRLvCAd.exe
  C:\Windows\System\QRLvCAd.exe
  2⤵
  PID:5688
- C:\Windows\System\CJeErla.exe
  C:\Windows\System\CJeErla.exe
  2⤵
  PID:6096
- C:\Windows\System\VTjSrjD.exe
  C:\Windows\System\VTjSrjD.exe
  2⤵
  PID:1244
- C:\Windows\System\ZozwTBU.exe
  C:\Windows\System\ZozwTBU.exe
  2⤵
  PID:5296
- C:\Windows\System\rpQqQvn.exe
  C:\Windows\System\rpQqQvn.exe
  2⤵
  PID:5480
- C:\Windows\System\aLyIZFr.exe
  C:\Windows\System\aLyIZFr.exe
  2⤵
  PID:5300
- C:\Windows\System\tcYHuqb.exe
  C:\Windows\System\tcYHuqb.exe
  2⤵
  PID:5496
- C:\Windows\System\cUViEvv.exe
  C:\Windows\System\cUViEvv.exe
  2⤵
  PID:5508
- C:\Windows\System\WpJhWaD.exe
  C:\Windows\System\WpJhWaD.exe
  2⤵
  PID:5676
- C:\Windows\System\ThRbvaw.exe
  C:\Windows\System\ThRbvaw.exe
  2⤵
  PID:5900
- C:\Windows\System\movViZM.exe
  C:\Windows\System\movViZM.exe
  2⤵
  PID:5888
- C:\Windows\System\uOibivG.exe
  C:\Windows\System\uOibivG.exe
  2⤵
  PID:6032
- C:\Windows\System\NltfSuP.exe
  C:\Windows\System\NltfSuP.exe
  2⤵
  PID:6060
- C:\Windows\System\hGBgUfR.exe
  C:\Windows\System\hGBgUfR.exe
  2⤵
  PID:6076
- C:\Windows\System\jfOwGvV.exe
  C:\Windows\System\jfOwGvV.exe
  2⤵
  PID:5316
- C:\Windows\System\cqwHpEN.exe
  C:\Windows\System\cqwHpEN.exe
  2⤵
  PID:4840
- C:\Windows\System\XxEowwf.exe
  C:\Windows\System\XxEowwf.exe
  2⤵
  PID:2920
- C:\Windows\System\MRrKDfN.exe
  C:\Windows\System\MRrKDfN.exe
  2⤵
  PID:5352
- C:\Windows\System\CTIwvWm.exe
  C:\Windows\System\CTIwvWm.exe
  2⤵
  PID:5572
- C:\Windows\System\BfteTqf.exe
  C:\Windows\System\BfteTqf.exe
  2⤵
  PID:6124
- C:\Windows\System\VuZFjvg.exe
  C:\Windows\System\VuZFjvg.exe
  2⤵
  PID:5336
- C:\Windows\System\kANbZHE.exe
  C:\Windows\System\kANbZHE.exe
  2⤵
  PID:5772
- C:\Windows\System\XFFwGll.exe
  C:\Windows\System\XFFwGll.exe
  2⤵
  PID:5884
- C:\Windows\System\qKpLpRt.exe
  C:\Windows\System\qKpLpRt.exe
  2⤵
  PID:6016
- C:\Windows\System\QfZXuyz.exe
  C:\Windows\System\QfZXuyz.exe
  2⤵
  PID:5308
- C:\Windows\System\WTDAuBU.exe
  C:\Windows\System\WTDAuBU.exe
  2⤵
  PID:5432
- C:\Windows\System\dUkmVvw.exe
  C:\Windows\System\dUkmVvw.exe
  2⤵
  PID:5708
- C:\Windows\System\FXxMBEF.exe
  C:\Windows\System\FXxMBEF.exe
  2⤵
  PID:6156
- C:\Windows\System\wMUHnev.exe
  C:\Windows\System\wMUHnev.exe
  2⤵
  PID:6172
- C:\Windows\System\toTCiGb.exe
  C:\Windows\System\toTCiGb.exe
  2⤵
  PID:6188
- C:\Windows\System\SJtcbqa.exe
  C:\Windows\System\SJtcbqa.exe
  2⤵
  PID:6212
- C:\Windows\System\yotYSGf.exe
  C:\Windows\System\yotYSGf.exe
  2⤵
  PID:6228
- C:\Windows\System\WaNCXVN.exe
  C:\Windows\System\WaNCXVN.exe
  2⤵
  PID:6244
- C:\Windows\System\ezHviJb.exe
  C:\Windows\System\ezHviJb.exe
  2⤵
  PID:6260
- C:\Windows\System\BbpTNoC.exe
  C:\Windows\System\BbpTNoC.exe
  2⤵
  PID:6276
- C:\Windows\System\CRjXyie.exe
  C:\Windows\System\CRjXyie.exe
  2⤵
  PID:6292
- C:\Windows\System\kRuBZgR.exe
  C:\Windows\System\kRuBZgR.exe
  2⤵
  PID:6308
- C:\Windows\System\THGrLzt.exe
  C:\Windows\System\THGrLzt.exe
  2⤵
  PID:6324
- C:\Windows\System\TmLUBcx.exe
  C:\Windows\System\TmLUBcx.exe
  2⤵
  PID:6344
- C:\Windows\System\OQwJvjY.exe
  C:\Windows\System\OQwJvjY.exe
  2⤵
  PID:6360
- C:\Windows\System\FbKBoCP.exe
  C:\Windows\System\FbKBoCP.exe
  2⤵
  PID:6376
- C:\Windows\System\MzRbHxT.exe
  C:\Windows\System\MzRbHxT.exe
  2⤵
  PID:6392
- C:\Windows\System\HsvaHfD.exe
  C:\Windows\System\HsvaHfD.exe
  2⤵
  PID:6408
- C:\Windows\System\pEQnulD.exe
  C:\Windows\System\pEQnulD.exe
  2⤵
  PID:6424
- C:\Windows\System\THUcCCV.exe
  C:\Windows\System\THUcCCV.exe
  2⤵
  PID:6440
- C:\Windows\System\sqwmexC.exe
  C:\Windows\System\sqwmexC.exe
  2⤵
  PID:6456
- C:\Windows\System\akzOwfZ.exe
  C:\Windows\System\akzOwfZ.exe
  2⤵
  PID:6472
- C:\Windows\System\KBESZBu.exe
  C:\Windows\System\KBESZBu.exe
  2⤵
  PID:6488
- C:\Windows\System\XgeSCpw.exe
  C:\Windows\System\XgeSCpw.exe
  2⤵
  PID:6504
- C:\Windows\System\UkxOzMn.exe
  C:\Windows\System\UkxOzMn.exe
  2⤵
  PID:6520
- C:\Windows\System\xnFKfix.exe
  C:\Windows\System\xnFKfix.exe
  2⤵
  PID:6536
- C:\Windows\System\betHdSZ.exe
  C:\Windows\System\betHdSZ.exe
  2⤵
  PID:6556
- C:\Windows\System\HJENIUs.exe
  C:\Windows\System\HJENIUs.exe
  2⤵
  PID:6572
- C:\Windows\System\gKNMfAP.exe
  C:\Windows\System\gKNMfAP.exe
  2⤵
  PID:6588
- C:\Windows\System\MftORZX.exe
  C:\Windows\System\MftORZX.exe
  2⤵
  PID:6604
- C:\Windows\System\CEimAxe.exe
  C:\Windows\System\CEimAxe.exe
  2⤵
  PID:6624
- C:\Windows\System\CpLIElV.exe
  C:\Windows\System\CpLIElV.exe
  2⤵
  PID:6640
- C:\Windows\System\DiBYRHM.exe
  C:\Windows\System\DiBYRHM.exe
  2⤵
  PID:6656
- C:\Windows\System\VVHGPZn.exe
  C:\Windows\System\VVHGPZn.exe
  2⤵
  PID:6676
- C:\Windows\System\BViLEyF.exe
  C:\Windows\System\BViLEyF.exe
  2⤵
  PID:6692
- C:\Windows\System\uqAiYLy.exe
  C:\Windows\System\uqAiYLy.exe
  2⤵
  PID:6708
- C:\Windows\System\TMUCrkg.exe
  C:\Windows\System\TMUCrkg.exe
  2⤵
  PID:6724
- C:\Windows\System\kWZOvfl.exe
  C:\Windows\System\kWZOvfl.exe
  2⤵
  PID:6744
- C:\Windows\System\zpdmdtk.exe
  C:\Windows\System\zpdmdtk.exe
  2⤵
  PID:6760
- C:\Windows\System\wtILOnY.exe
  C:\Windows\System\wtILOnY.exe
  2⤵
  PID:6780
- C:\Windows\System\wHumaUD.exe
  C:\Windows\System\wHumaUD.exe
  2⤵
  PID:6800
- C:\Windows\System\WotEqrw.exe
  C:\Windows\System\WotEqrw.exe
  2⤵
  PID:6816
- C:\Windows\System\tYVhyQD.exe
  C:\Windows\System\tYVhyQD.exe
  2⤵
  PID:6832
- C:\Windows\System\JhJoYTd.exe
  C:\Windows\System\JhJoYTd.exe
  2⤵
  PID:6848
- C:\Windows\System\yQbYWiS.exe
  C:\Windows\System\yQbYWiS.exe
  2⤵
  PID:6864
- C:\Windows\System\psHWniM.exe
  C:\Windows\System\psHWniM.exe
  2⤵
  PID:6880
- C:\Windows\System\HqfTyYv.exe
  C:\Windows\System\HqfTyYv.exe
  2⤵
  PID:6896
- C:\Windows\System\FzWpUEj.exe
  C:\Windows\System\FzWpUEj.exe
  2⤵
  PID:6912
- C:\Windows\System\PqZQqsq.exe
  C:\Windows\System\PqZQqsq.exe
  2⤵
  PID:6928
- C:\Windows\System\QxFEAik.exe
  C:\Windows\System\QxFEAik.exe
  2⤵
  PID:6944
- C:\Windows\System\toglCfl.exe
  C:\Windows\System\toglCfl.exe
  2⤵
  PID:6960
- C:\Windows\System\hOmaTwC.exe
  C:\Windows\System\hOmaTwC.exe
  2⤵
  PID:6976
- C:\Windows\System\ESNLSZj.exe
  C:\Windows\System\ESNLSZj.exe
  2⤵
  PID:6992
- C:\Windows\System\HUxnwhC.exe
  C:\Windows\System\HUxnwhC.exe
  2⤵
  PID:7008
- C:\Windows\System\yaMSsVA.exe
  C:\Windows\System\yaMSsVA.exe
  2⤵
  PID:7024
- C:\Windows\System\NcckfhK.exe
  C:\Windows\System\NcckfhK.exe
  2⤵
  PID:7040
- C:\Windows\System\klbukme.exe
  C:\Windows\System\klbukme.exe
  2⤵
  PID:7056
- C:\Windows\System\nUDefIY.exe
  C:\Windows\System\nUDefIY.exe
  2⤵
  PID:7072
- C:\Windows\System\MEwYuNP.exe
  C:\Windows\System\MEwYuNP.exe
  2⤵
  PID:7088
- C:\Windows\System\gGQPQOc.exe
  C:\Windows\System\gGQPQOc.exe
  2⤵
  PID:7104
- C:\Windows\System\avdGAFG.exe
  C:\Windows\System\avdGAFG.exe
  2⤵
  PID:7120
- C:\Windows\System\OBYUqPK.exe
  C:\Windows\System\OBYUqPK.exe
  2⤵
  PID:7136
- C:\Windows\System\vSqqinG.exe
  C:\Windows\System\vSqqinG.exe
  2⤵
  PID:7152
- C:\Windows\System\LsqrXTf.exe
  C:\Windows\System\LsqrXTf.exe
  2⤵
  PID:5168
- C:\Windows\System\Ztxsksm.exe
  C:\Windows\System\Ztxsksm.exe
  2⤵
  PID:6196
- C:\Windows\System\ywavMcR.exe
  C:\Windows\System\ywavMcR.exe
  2⤵
  PID:6184
- C:\Windows\System\nCeCUCw.exe
  C:\Windows\System\nCeCUCw.exe
  2⤵
  PID:6020
- C:\Windows\System\eqZUydm.exe
  C:\Windows\System\eqZUydm.exe
  2⤵
  PID:5808
- C:\Windows\System\SoDlnvG.exe
  C:\Windows\System\SoDlnvG.exe
  2⤵
  PID:5820
- C:\Windows\System\DZrqMZq.exe
  C:\Windows\System\DZrqMZq.exe
  2⤵
  PID:6148
- C:\Windows\System\NRzofqo.exe
  C:\Windows\System\NRzofqo.exe
  2⤵
  PID:6236
- C:\Windows\System\nCWzOCB.exe
  C:\Windows\System\nCWzOCB.exe
  2⤵
  PID:6268
- C:\Windows\System\GCwOcmy.exe
  C:\Windows\System\GCwOcmy.exe
  2⤵
  PID:6332
- C:\Windows\System\oawHkVg.exe
  C:\Windows\System\oawHkVg.exe
  2⤵
  PID:6336
- C:\Windows\System\AxlpHbC.exe
  C:\Windows\System\AxlpHbC.exe
  2⤵
  PID:6320
- C:\Windows\System\CcVzHor.exe
  C:\Windows\System\CcVzHor.exe
  2⤵
  PID:6384
- C:\Windows\System\obyEuJh.exe
  C:\Windows\System\obyEuJh.exe
  2⤵
  PID:6368
- C:\Windows\System\WscdVrg.exe
  C:\Windows\System\WscdVrg.exe
  2⤵
  PID:6432
- C:\Windows\System\bLjEcjC.exe
  C:\Windows\System\bLjEcjC.exe
  2⤵
  PID:6464
- C:\Windows\System\witEKjO.exe
  C:\Windows\System\witEKjO.exe
  2⤵
  PID:6512
- C:\Windows\System\YOhHnYo.exe
  C:\Windows\System\YOhHnYo.exe
  2⤵
  PID:6552
- C:\Windows\System\BtEFLnY.exe
  C:\Windows\System\BtEFLnY.exe
  2⤵
  PID:6496
- C:\Windows\System\cVwArcl.exe
  C:\Windows\System\cVwArcl.exe
  2⤵
  PID:6532
- C:\Windows\System\hEzxOuO.exe
  C:\Windows\System\hEzxOuO.exe
  2⤵
  PID:6616
- C:\Windows\System\ZFWPAXn.exe
  C:\Windows\System\ZFWPAXn.exe
  2⤵
  PID:6652
- C:\Windows\System\XpiRAOf.exe
  C:\Windows\System\XpiRAOf.exe
  2⤵
  PID:6664
- C:\Windows\System\hJXxiul.exe
  C:\Windows\System\hJXxiul.exe
  2⤵
  PID:6684
- C:\Windows\System\GgWOnLE.exe
  C:\Windows\System\GgWOnLE.exe
  2⤵
  PID:6772
- C:\Windows\System\aMZwEte.exe
  C:\Windows\System\aMZwEte.exe
  2⤵
  PID:6812
- C:\Windows\System\IBNNqKx.exe
  C:\Windows\System\IBNNqKx.exe
  2⤵
  PID:6904
- C:\Windows\System\ACkqGqS.exe
  C:\Windows\System\ACkqGqS.exe
  2⤵
  PID:6908
- C:\Windows\System\zwywvAl.exe
  C:\Windows\System\zwywvAl.exe
  2⤵
  PID:6716
- C:\Windows\System\eRJQwQK.exe
  C:\Windows\System\eRJQwQK.exe
  2⤵
  PID:6860
- C:\Windows\System\uJiddmH.exe
  C:\Windows\System\uJiddmH.exe
  2⤵
  PID:6972
- C:\Windows\System\iFpOIhA.exe
  C:\Windows\System\iFpOIhA.exe
  2⤵
  PID:6892
- C:\Windows\System\bdGbiNo.exe
  C:\Windows\System\bdGbiNo.exe
  2⤵
  PID:7096
- C:\Windows\System\OgBzxPn.exe
  C:\Windows\System\OgBzxPn.exe
  2⤵
  PID:7048
- C:\Windows\System\CYNPHTw.exe
  C:\Windows\System\CYNPHTw.exe
  2⤵
  PID:7080
- C:\Windows\System\upKcTbH.exe
  C:\Windows\System\upKcTbH.exe
  2⤵
  PID:7020
- C:\Windows\System\ikupfTn.exe
  C:\Windows\System\ikupfTn.exe
  2⤵
  PID:7164
- C:\Windows\System\oqOsgAF.exe
  C:\Windows\System\oqOsgAF.exe
  2⤵
  PID:6012
- C:\Windows\System\nSPFmEG.exe
  C:\Windows\System\nSPFmEG.exe
  2⤵
  PID:5268
- C:\Windows\System\PJWGjtZ.exe
  C:\Windows\System\PJWGjtZ.exe
  2⤵
  PID:5320
- C:\Windows\System\PKZdDxR.exe
  C:\Windows\System\PKZdDxR.exe
  2⤵
  PID:6240
- C:\Windows\System\eiUjoTA.exe
  C:\Windows\System\eiUjoTA.exe
  2⤵
  PID:6352
- C:\Windows\System\copevuw.exe
  C:\Windows\System\copevuw.exe
  2⤵
  PID:6284
- C:\Windows\System\zAvLBOo.exe
  C:\Windows\System\zAvLBOo.exe
  2⤵
  PID:6404
- C:\Windows\System\LSfdurf.exe
  C:\Windows\System\LSfdurf.exe
  2⤵
  PID:6448
- C:\Windows\System\EQMuntv.exe
  C:\Windows\System\EQMuntv.exe
  2⤵
  PID:6612
- C:\Windows\System\gwlWQXu.exe
  C:\Windows\System\gwlWQXu.exe
  2⤵
  PID:6740
- C:\Windows\System\nffrCqf.exe
  C:\Windows\System\nffrCqf.exe
  2⤵
  PID:6788
- C:\Windows\System\ohXCDYI.exe
  C:\Windows\System\ohXCDYI.exe
  2⤵
  PID:6968
- C:\Windows\System\nsgMPrj.exe
  C:\Windows\System\nsgMPrj.exe
  2⤵
  PID:6984
- C:\Windows\System\TZVVJPV.exe
  C:\Windows\System\TZVVJPV.exe
  2⤵
  PID:7160
- C:\Windows\System\qPRUHoC.exe
  C:\Windows\System\qPRUHoC.exe
  2⤵
  PID:5652
- C:\Windows\System\qseRKbp.exe
  C:\Windows\System\qseRKbp.exe
  2⤵
  PID:6416
- C:\Windows\System\xDFKcmr.exe
  C:\Windows\System\xDFKcmr.exe
  2⤵
  PID:6500
- C:\Windows\System\KmQXTxs.exe
  C:\Windows\System\KmQXTxs.exe
  2⤵
  PID:6856
- C:\Windows\System\lpthaye.exe
  C:\Windows\System\lpthaye.exe
  2⤵
  PID:6988
- C:\Windows\System\twwlqUy.exe
  C:\Windows\System\twwlqUy.exe
  2⤵
  PID:6164
- C:\Windows\System\systEVa.exe
  C:\Windows\System\systEVa.exe
  2⤵
  PID:2676
- C:\Windows\System\NTwYxty.exe
  C:\Windows\System\NTwYxty.exe
  2⤵
  PID:6568
- C:\Windows\System\eZDriSl.exe
  C:\Windows\System\eZDriSl.exe
  2⤵
  PID:6796
- C:\Windows\System\AYNOBRh.exe
  C:\Windows\System\AYNOBRh.exe
  2⤵
  PID:6956
- C:\Windows\System\iSUDQZq.exe
  C:\Windows\System\iSUDQZq.exe
  2⤵
  PID:1584
- C:\Windows\System\rRKpqHw.exe
  C:\Windows\System\rRKpqHw.exe
  2⤵
  PID:6528
- C:\Windows\System\ZQxMxdZ.exe
  C:\Windows\System\ZQxMxdZ.exe
  2⤵
  PID:6736
- C:\Windows\System\PiXVZaJ.exe
  C:\Windows\System\PiXVZaJ.exe
  2⤵
  PID:6808
- C:\Windows\System\UWbamIF.exe
  C:\Windows\System\UWbamIF.exe
  2⤵
  PID:7144
- C:\Windows\System\Niuckub.exe
  C:\Windows\System\Niuckub.exe
  2⤵
  PID:7132
- C:\Windows\System\TAYFsGt.exe
  C:\Windows\System\TAYFsGt.exe
  2⤵
  PID:6584
- C:\Windows\System\ZmXoIjU.exe
  C:\Windows\System\ZmXoIjU.exe
  2⤵
  PID:6204
- C:\Windows\System\BZvlViq.exe
  C:\Windows\System\BZvlViq.exe
  2⤵
  PID:6732
- C:\Windows\System\LJdRlvg.exe
  C:\Windows\System\LJdRlvg.exe
  2⤵
  PID:6720
- C:\Windows\System\lVbnvyF.exe
  C:\Windows\System\lVbnvyF.exe
  2⤵
  PID:6544
- C:\Windows\System\HbHupVv.exe
  C:\Windows\System\HbHupVv.exe
  2⤵
  PID:2348
- C:\Windows\System\DznZRvI.exe
  C:\Windows\System\DznZRvI.exe
  2⤵
  PID:7064
- C:\Windows\System\UDUClDm.exe
  C:\Windows\System\UDUClDm.exe
  2⤵
  PID:6768
- C:\Windows\System\vRzvFJA.exe
  C:\Windows\System\vRzvFJA.exe
  2⤵
  PID:7172
- C:\Windows\System\JsvLDAA.exe
  C:\Windows\System\JsvLDAA.exe
  2⤵
  PID:7188
- C:\Windows\System\QDXympK.exe
  C:\Windows\System\QDXympK.exe
  2⤵
  PID:7208
- C:\Windows\System\NiURbjF.exe
  C:\Windows\System\NiURbjF.exe
  2⤵
  PID:7224
- C:\Windows\System\tdryoTQ.exe
  C:\Windows\System\tdryoTQ.exe
  2⤵
  PID:7240
- C:\Windows\System\xWQIFjO.exe
  C:\Windows\System\xWQIFjO.exe
  2⤵
  PID:7256
- C:\Windows\System\pXGvSaS.exe
  C:\Windows\System\pXGvSaS.exe
  2⤵
  PID:7272
- C:\Windows\System\JYvatYU.exe
  C:\Windows\System\JYvatYU.exe
  2⤵
  PID:7288
- C:\Windows\System\tabFEMo.exe
  C:\Windows\System\tabFEMo.exe
  2⤵
  PID:7304
- C:\Windows\System\McjRInq.exe
  C:\Windows\System\McjRInq.exe
  2⤵
  PID:7320
- C:\Windows\System\azTpHyu.exe
  C:\Windows\System\azTpHyu.exe
  2⤵
  PID:7336
- C:\Windows\System\TqZhhXK.exe
  C:\Windows\System\TqZhhXK.exe
  2⤵
  PID:7352
- C:\Windows\System\AiPXBnq.exe
  C:\Windows\System\AiPXBnq.exe
  2⤵
  PID:7368
- C:\Windows\System\XMJUsAN.exe
  C:\Windows\System\XMJUsAN.exe
  2⤵
  PID:7384
- C:\Windows\System\xuThUGk.exe
  C:\Windows\System\xuThUGk.exe
  2⤵
  PID:7400
- C:\Windows\System\QdLcYGl.exe
  C:\Windows\System\QdLcYGl.exe
  2⤵
  PID:7416
- C:\Windows\System\sDuqEAl.exe
  C:\Windows\System\sDuqEAl.exe
  2⤵
  PID:7432
- C:\Windows\System\vdORhrh.exe
  C:\Windows\System\vdORhrh.exe
  2⤵
  PID:7448
- C:\Windows\System\IwwJSCz.exe
  C:\Windows\System\IwwJSCz.exe
  2⤵
  PID:7464
- C:\Windows\System\XnSURph.exe
  C:\Windows\System\XnSURph.exe
  2⤵
  PID:7480
- C:\Windows\System\GsJWHNi.exe
  C:\Windows\System\GsJWHNi.exe
  2⤵
  PID:7496
- C:\Windows\System\PJBvczw.exe
  C:\Windows\System\PJBvczw.exe
  2⤵
  PID:7512
- C:\Windows\System\uYjhvbl.exe
  C:\Windows\System\uYjhvbl.exe
  2⤵
  PID:7528
- C:\Windows\System\NtjPNZl.exe
  C:\Windows\System\NtjPNZl.exe
  2⤵
  PID:7544
- C:\Windows\System\FOpiTPP.exe
  C:\Windows\System\FOpiTPP.exe
  2⤵
  PID:7560
- C:\Windows\System\PBNWoMD.exe
  C:\Windows\System\PBNWoMD.exe
  2⤵
  PID:7576
- C:\Windows\System\bBAiOHo.exe
  C:\Windows\System\bBAiOHo.exe
  2⤵
  PID:7592
- C:\Windows\System\ISwEtad.exe
  C:\Windows\System\ISwEtad.exe
  2⤵
  PID:7608
- C:\Windows\System\kftxghO.exe
  C:\Windows\System\kftxghO.exe
  2⤵
  PID:7624
- C:\Windows\System\QCmolVb.exe
  C:\Windows\System\QCmolVb.exe
  2⤵
  PID:7640
- C:\Windows\System\dcYwYyQ.exe
  C:\Windows\System\dcYwYyQ.exe
  2⤵
  PID:7656
- C:\Windows\System\WSCbgeb.exe
  C:\Windows\System\WSCbgeb.exe
  2⤵
  PID:7672
- C:\Windows\System\EkAiZlS.exe
  C:\Windows\System\EkAiZlS.exe
  2⤵
  PID:7688
- C:\Windows\System\mBfVYww.exe
  C:\Windows\System\mBfVYww.exe
  2⤵
  PID:7704
- C:\Windows\System\NkAQVKF.exe
  C:\Windows\System\NkAQVKF.exe
  2⤵
  PID:7720
- C:\Windows\System\JMswxXy.exe
  C:\Windows\System\JMswxXy.exe
  2⤵
  PID:7736
- C:\Windows\System\fmQDVAu.exe
  C:\Windows\System\fmQDVAu.exe
  2⤵
  PID:7752
- C:\Windows\System\YnIoKHX.exe
  C:\Windows\System\YnIoKHX.exe
  2⤵
  PID:7768
- C:\Windows\System\YMQTQOc.exe
  C:\Windows\System\YMQTQOc.exe
  2⤵
  PID:7788
- C:\Windows\System\jCWmZYc.exe
  C:\Windows\System\jCWmZYc.exe
  2⤵
  PID:7804
- C:\Windows\System\DyGggUs.exe
  C:\Windows\System\DyGggUs.exe
  2⤵
  PID:7820
- C:\Windows\System\jsHCUmf.exe
  C:\Windows\System\jsHCUmf.exe
  2⤵
  PID:7836
- C:\Windows\System\kjlHLEl.exe
  C:\Windows\System\kjlHLEl.exe
  2⤵
  PID:7852
- C:\Windows\System\brasfjw.exe
  C:\Windows\System\brasfjw.exe
  2⤵
  PID:7868
- C:\Windows\System\VBZinsX.exe
  C:\Windows\System\VBZinsX.exe
  2⤵
  PID:7884
- C:\Windows\System\kjbLtew.exe
  C:\Windows\System\kjbLtew.exe
  2⤵
  PID:7900
- C:\Windows\System\uZbTnUf.exe
  C:\Windows\System\uZbTnUf.exe
  2⤵
  PID:7916
- C:\Windows\System\fZvUqbw.exe
  C:\Windows\System\fZvUqbw.exe
  2⤵
  PID:7932
- C:\Windows\System\DWiACdF.exe
  C:\Windows\System\DWiACdF.exe
  2⤵
  PID:7948
- C:\Windows\System\YgvbAVF.exe
  C:\Windows\System\YgvbAVF.exe
  2⤵
  PID:7964
- C:\Windows\System\AaIsoIM.exe
  C:\Windows\System\AaIsoIM.exe
  2⤵
  PID:7980
- C:\Windows\System\UxlyftA.exe
  C:\Windows\System\UxlyftA.exe
  2⤵
  PID:7996
- C:\Windows\System\IUWJTbJ.exe
  C:\Windows\System\IUWJTbJ.exe
  2⤵
  PID:8012
- C:\Windows\System\bkgzzPh.exe
  C:\Windows\System\bkgzzPh.exe
  2⤵
  PID:8028
- C:\Windows\System\wlwoJMf.exe
  C:\Windows\System\wlwoJMf.exe
  2⤵
  PID:8044
- C:\Windows\System\LiMDoAH.exe
  C:\Windows\System\LiMDoAH.exe
  2⤵
  PID:8060
- C:\Windows\System\WXRuIcM.exe
  C:\Windows\System\WXRuIcM.exe
  2⤵
  PID:8076
- C:\Windows\System\hUwrxOT.exe
  C:\Windows\System\hUwrxOT.exe
  2⤵
  PID:8104
- C:\Windows\System\gxqyXrc.exe
  C:\Windows\System\gxqyXrc.exe
  2⤵
  PID:8120
- C:\Windows\System\qRieWHc.exe
  C:\Windows\System\qRieWHc.exe
  2⤵
  PID:8136
- C:\Windows\System\iGBearR.exe
  C:\Windows\System\iGBearR.exe
  2⤵
  PID:8152
- C:\Windows\System\mYTdhee.exe
  C:\Windows\System\mYTdhee.exe
  2⤵
  PID:8168
- C:\Windows\System\NuUTgUe.exe
  C:\Windows\System\NuUTgUe.exe
  2⤵
  PID:8184
- C:\Windows\System\thKgAYL.exe
  C:\Windows\System\thKgAYL.exe
  2⤵
  PID:6632
- C:\Windows\System\ONYjvCP.exe
  C:\Windows\System\ONYjvCP.exe
  2⤵
  PID:7216
- C:\Windows\System\wLqLpld.exe
  C:\Windows\System\wLqLpld.exe
  2⤵
  PID:7280
- C:\Windows\System\rIfdKrF.exe
  C:\Windows\System\rIfdKrF.exe
  2⤵
  PID:7344
- C:\Windows\System\RIARYqk.exe
  C:\Windows\System\RIARYqk.exe
  2⤵
  PID:7408
- C:\Windows\System\UtWHyzJ.exe
  C:\Windows\System\UtWHyzJ.exe
  2⤵
  PID:7204
- C:\Windows\System\tizMtEI.exe
  C:\Windows\System\tizMtEI.exe
  2⤵
  PID:7296
- C:\Windows\System\GDdZcFW.exe
  C:\Windows\System\GDdZcFW.exe
  2⤵
  PID:7332
- C:\Windows\System\FVfiOhX.exe
  C:\Windows\System\FVfiOhX.exe
  2⤵
  PID:7424
- C:\Windows\System\keGMlfZ.exe
  C:\Windows\System\keGMlfZ.exe
  2⤵
  PID:7472
- C:\Windows\System\ohBAacH.exe
  C:\Windows\System\ohBAacH.exe
  2⤵
  PID:7536
- C:\Windows\System\lytsagv.exe
  C:\Windows\System\lytsagv.exe
  2⤵
  PID:7600
- C:\Windows\System\FEfTDiz.exe
  C:\Windows\System\FEfTDiz.exe
  2⤵
  PID:7664
- C:\Windows\System\sCdUXgw.exe
  C:\Windows\System\sCdUXgw.exe
  2⤵
  PID:7728
- C:\Windows\System\nTpDSuY.exe
  C:\Windows\System\nTpDSuY.exe
  2⤵
  PID:7552
- C:\Windows\System\lDLQajW.exe
  C:\Windows\System\lDLQajW.exe
  2⤵
  PID:7616
- C:\Windows\System\ZrLuIxo.exe
  C:\Windows\System\ZrLuIxo.exe
  2⤵
  PID:7760
- C:\Windows\System\eJpHzQq.exe
  C:\Windows\System\eJpHzQq.exe
  2⤵
  PID:7620
- C:\Windows\System\PwvWdHZ.exe
  C:\Windows\System\PwvWdHZ.exe
  2⤵
  PID:7712
- C:\Windows\System\owvMplJ.exe
  C:\Windows\System\owvMplJ.exe
  2⤵
  PID:7828
- C:\Windows\System\aqOsOik.exe
  C:\Windows\System\aqOsOik.exe
  2⤵
  PID:7892
- C:\Windows\System\nlGtMxr.exe
  C:\Windows\System\nlGtMxr.exe
  2⤵
  PID:7956
- C:\Windows\System\ytrFbHW.exe
  C:\Windows\System\ytrFbHW.exe
  2⤵
  PID:8020
- C:\Windows\System\nWiHQfy.exe
  C:\Windows\System\nWiHQfy.exe
  2⤵
  PID:8052
- C:\Windows\System\gxsaGba.exe
  C:\Windows\System\gxsaGba.exe
  2⤵
  PID:7844
- C:\Windows\System\AfoFMgh.exe
  C:\Windows\System\AfoFMgh.exe
  2⤵
  PID:7784
- C:\Windows\System\xYrXUdr.exe
  C:\Windows\System\xYrXUdr.exe
  2⤵
  PID:7880
- C:\Windows\System\UnlKMPl.exe
  C:\Windows\System\UnlKMPl.exe
  2⤵
  PID:7972
- C:\Windows\System\cfCZlbB.exe
  C:\Windows\System\cfCZlbB.exe
  2⤵
  PID:8036
- C:\Windows\System\lUWfYaK.exe
  C:\Windows\System\lUWfYaK.exe
  2⤵
  PID:8088
- C:\Windows\System\kPacXLX.exe
  C:\Windows\System\kPacXLX.exe
  2⤵
  PID:8148
- C:\Windows\System\VIFzHNE.exe
  C:\Windows\System\VIFzHNE.exe
  2⤵
  PID:8160
- C:\Windows\System\FeZGruv.exe
  C:\Windows\System\FeZGruv.exe
  2⤵
  PID:7180
- C:\Windows\System\sYhaGnK.exe
  C:\Windows\System\sYhaGnK.exe
  2⤵
  PID:7376
- C:\Windows\System\CDppcop.exe
  C:\Windows\System\CDppcop.exe
  2⤵
  PID:7364
- C:\Windows\System\RtwAsBk.exe
  C:\Windows\System\RtwAsBk.exe
  2⤵
  PID:7632
- C:\Windows\System\FgaPIMn.exe
  C:\Windows\System\FgaPIMn.exe
  2⤵
  PID:7456
- C:\Windows\System\ArjRLrt.exe
  C:\Windows\System\ArjRLrt.exe
  2⤵
  PID:8180
- C:\Windows\System\otsgWHs.exe
  C:\Windows\System\otsgWHs.exe
  2⤵
  PID:7864
- C:\Windows\System\GniRGZB.exe
  C:\Windows\System\GniRGZB.exe
  2⤵
  PID:7816
- C:\Windows\System\jyVKUNQ.exe
  C:\Windows\System\jyVKUNQ.exe
  2⤵
  PID:7700
- C:\Windows\System\qUbxySA.exe
  C:\Windows\System\qUbxySA.exe
  2⤵
  PID:7232
- C:\Windows\System\dTJnBIJ.exe
  C:\Windows\System\dTJnBIJ.exe
  2⤵
  PID:7556
- C:\Windows\System\vEMtTFo.exe
  C:\Windows\System\vEMtTFo.exe
  2⤵
  PID:7748
- C:\Windows\System\egMOjvm.exe
  C:\Windows\System\egMOjvm.exe
  2⤵
  PID:7940
- C:\Windows\System\RMGTWNV.exe
  C:\Windows\System\RMGTWNV.exe
  2⤵
  PID:7492
- C:\Windows\System\yTuHWRQ.exe
  C:\Windows\System\yTuHWRQ.exe
  2⤵
  PID:7796
- C:\Windows\System\oPABVfu.exe
  C:\Windows\System\oPABVfu.exe
  2⤵
  PID:7588
- C:\Windows\System\KsvwmJx.exe
  C:\Windows\System\KsvwmJx.exe
  2⤵
  PID:8164
- C:\Windows\System\fnQGnyb.exe
  C:\Windows\System\fnQGnyb.exe
  2⤵
  PID:7524
- C:\Windows\System\IWbjdoB.exe
  C:\Windows\System\IWbjdoB.exe
  2⤵
  PID:7312
- C:\Windows\System\SJTbtRb.exe
  C:\Windows\System\SJTbtRb.exe
  2⤵
  PID:7184
- C:\Windows\System\eJKNUFK.exe
  C:\Windows\System\eJKNUFK.exe
  2⤵
  PID:8084
- C:\Windows\System\nDQhPFw.exe
  C:\Windows\System\nDQhPFw.exe
  2⤵
  PID:8112
- C:\Windows\System\xOEnqmG.exe
  C:\Windows\System\xOEnqmG.exe
  2⤵
  PID:7876
- C:\Windows\System\tuyNsQA.exe
  C:\Windows\System\tuyNsQA.exe
  2⤵
  PID:7504
- C:\Windows\System\XBjKCCk.exe
  C:\Windows\System\XBjKCCk.exe
  2⤵
  PID:8128
- C:\Windows\System\jimruRB.exe
  C:\Windows\System\jimruRB.exe
  2⤵
  PID:7196
- C:\Windows\System\JcySIxt.exe
  C:\Windows\System\JcySIxt.exe
  2⤵
  PID:7264
- C:\Windows\System\kKBMqqU.exe
  C:\Windows\System\kKBMqqU.exe
  2⤵
  PID:7508
- C:\Windows\System\DeHXYgR.exe
  C:\Windows\System\DeHXYgR.exe
  2⤵
  PID:7776
- C:\Windows\System\UhszfPG.exe
  C:\Windows\System\UhszfPG.exe
  2⤵
  PID:7696
- C:\Windows\System\zAjWRJj.exe
  C:\Windows\System\zAjWRJj.exe
  2⤵
  PID:7944
- C:\Windows\System\vPKAuiw.exe
  C:\Windows\System\vPKAuiw.exe
  2⤵
  PID:8208
- C:\Windows\System\maeqOCp.exe
  C:\Windows\System\maeqOCp.exe
  2⤵
  PID:8224
- C:\Windows\System\zNtgiVs.exe
  C:\Windows\System\zNtgiVs.exe
  2⤵
  PID:8240
- C:\Windows\System\EruqXxO.exe
  C:\Windows\System\EruqXxO.exe
  2⤵
  PID:8256
- C:\Windows\System\oETFrjm.exe
  C:\Windows\System\oETFrjm.exe
  2⤵
  PID:8272
- C:\Windows\System\lCYuLXk.exe
  C:\Windows\System\lCYuLXk.exe
  2⤵
  PID:8288
- C:\Windows\System\DTlbbHC.exe
  C:\Windows\System\DTlbbHC.exe
  2⤵
  PID:8304
- C:\Windows\System\UyJbhIz.exe
  C:\Windows\System\UyJbhIz.exe
  2⤵
  PID:8320
- C:\Windows\System\oNizoAD.exe
  C:\Windows\System\oNizoAD.exe
  2⤵
  PID:8336
- C:\Windows\System\JMkamii.exe
  C:\Windows\System\JMkamii.exe
  2⤵
  PID:8352
- C:\Windows\System\yzpjzYg.exe
  C:\Windows\System\yzpjzYg.exe
  2⤵
  PID:8368
- C:\Windows\System\MNYayAC.exe
  C:\Windows\System\MNYayAC.exe
  2⤵
  PID:8384
- C:\Windows\System\ClytuIF.exe
  C:\Windows\System\ClytuIF.exe
  2⤵
  PID:8496
- C:\Windows\System\WhtyCji.exe
  C:\Windows\System\WhtyCji.exe
  2⤵
  PID:8512
- C:\Windows\System\wIZwQqt.exe
  C:\Windows\System\wIZwQqt.exe
  2⤵
  PID:8528
- C:\Windows\System\qnbTRXg.exe
  C:\Windows\System\qnbTRXg.exe
  2⤵
  PID:8544
- C:\Windows\System\xCJXTJs.exe
  C:\Windows\System\xCJXTJs.exe
  2⤵
  PID:8560
- C:\Windows\System\CYkMbZb.exe
  C:\Windows\System\CYkMbZb.exe
  2⤵
  PID:8576
- C:\Windows\System\CSWpiTo.exe
  C:\Windows\System\CSWpiTo.exe
  2⤵
  PID:8592
- C:\Windows\System\ElGCkqJ.exe
  C:\Windows\System\ElGCkqJ.exe
  2⤵
  PID:8608
- C:\Windows\System\ifanwHZ.exe
  C:\Windows\System\ifanwHZ.exe
  2⤵
  PID:8632
- C:\Windows\System\QIeaEyU.exe
  C:\Windows\System\QIeaEyU.exe
  2⤵
  PID:8652
- C:\Windows\System\wxxbYZn.exe
  C:\Windows\System\wxxbYZn.exe
  2⤵
  PID:8668
- C:\Windows\System\MZBHiJS.exe
  C:\Windows\System\MZBHiJS.exe
  2⤵
  PID:8684
- C:\Windows\System\UWrLwns.exe
  C:\Windows\System\UWrLwns.exe
  2⤵
  PID:8704
- C:\Windows\System\oySEhZy.exe
  C:\Windows\System\oySEhZy.exe
  2⤵
  PID:8720
- C:\Windows\System\ZIqpVPo.exe
  C:\Windows\System\ZIqpVPo.exe
  2⤵
  PID:8736
- C:\Windows\System\kKBDvKz.exe
  C:\Windows\System\kKBDvKz.exe
  2⤵
  PID:8752
- C:\Windows\System\kuOvfhU.exe
  C:\Windows\System\kuOvfhU.exe
  2⤵
  PID:8768
- C:\Windows\System\XHuLJOn.exe
  C:\Windows\System\XHuLJOn.exe
  2⤵
  PID:8784
- C:\Windows\System\iawcGOO.exe
  C:\Windows\System\iawcGOO.exe
  2⤵
  PID:8800
- C:\Windows\System\GkOOhMd.exe
  C:\Windows\System\GkOOhMd.exe
  2⤵
  PID:8816
- C:\Windows\System\iDciQhH.exe
  C:\Windows\System\iDciQhH.exe
  2⤵
  PID:8832
- C:\Windows\System\wUWBsOZ.exe
  C:\Windows\System\wUWBsOZ.exe
  2⤵
  PID:8848
- C:\Windows\System\HQiIfvU.exe
  C:\Windows\System\HQiIfvU.exe
  2⤵
  PID:8864
- C:\Windows\System\qTMgedt.exe
  C:\Windows\System\qTMgedt.exe
  2⤵
  PID:8880
- C:\Windows\System\bBgobCC.exe
  C:\Windows\System\bBgobCC.exe
  2⤵
  PID:8896
- C:\Windows\System\wZznXce.exe
  C:\Windows\System\wZznXce.exe
  2⤵
  PID:8912
- C:\Windows\System\xlMDPZM.exe
  C:\Windows\System\xlMDPZM.exe
  2⤵
  PID:8928
- C:\Windows\System\izExPqS.exe
  C:\Windows\System\izExPqS.exe
  2⤵
  PID:8944
- C:\Windows\System\MEhrMUp.exe
  C:\Windows\System\MEhrMUp.exe
  2⤵
  PID:8968
- C:\Windows\System\AkhJtSD.exe
  C:\Windows\System\AkhJtSD.exe
  2⤵
  PID:9068
- C:\Windows\System\XPPXZGu.exe
  C:\Windows\System\XPPXZGu.exe
  2⤵
  PID:9088
- C:\Windows\System\QAWPcfL.exe
  C:\Windows\System\QAWPcfL.exe
  2⤵
  PID:9104
- C:\Windows\System\cxLAvIJ.exe
  C:\Windows\System\cxLAvIJ.exe
  2⤵
  PID:9120
- C:\Windows\System\ZyaZXym.exe
  C:\Windows\System\ZyaZXym.exe
  2⤵
  PID:9136
- C:\Windows\System\mpAHYqp.exe
  C:\Windows\System\mpAHYqp.exe
  2⤵
  PID:9152
- C:\Windows\System\qHFbTfJ.exe
  C:\Windows\System\qHFbTfJ.exe
  2⤵
  PID:9168
- C:\Windows\System\aTSNdfy.exe
  C:\Windows\System\aTSNdfy.exe
  2⤵
  PID:9184
- C:\Windows\System\yeZyMTG.exe
  C:\Windows\System\yeZyMTG.exe
  2⤵
  PID:9200
- C:\Windows\System\NMBIgWq.exe
  C:\Windows\System\NMBIgWq.exe
  2⤵
  PID:7316
- C:\Windows\System\iGZqCYU.exe
  C:\Windows\System\iGZqCYU.exe
  2⤵
  PID:8220
- C:\Windows\System\itNLaQY.exe
  C:\Windows\System\itNLaQY.exe
  2⤵
  PID:8284
- C:\Windows\System\UWwWCcG.exe
  C:\Windows\System\UWwWCcG.exe
  2⤵
  PID:8380
- C:\Windows\System\qHABKQy.exe
  C:\Windows\System\qHABKQy.exe
  2⤵
  PID:7444
- C:\Windows\System\OpkcWXg.exe
  C:\Windows\System\OpkcWXg.exe
  2⤵
  PID:8392
- C:\Windows\System\bGeZxgR.exe
  C:\Windows\System\bGeZxgR.exe
  2⤵
  PID:8328
- C:\Windows\System\PlAIPIU.exe
  C:\Windows\System\PlAIPIU.exe
  2⤵
  PID:8396
- C:\Windows\System\vVKqTbX.exe
  C:\Windows\System\vVKqTbX.exe
  2⤵
  PID:8416
- C:\Windows\System\lyOzKcG.exe
  C:\Windows\System\lyOzKcG.exe
  2⤵
  PID:5184
- C:\Windows\System\kLILBsF.exe
  C:\Windows\System\kLILBsF.exe
  2⤵
  PID:8424
- C:\Windows\System\rvgazMg.exe
  C:\Windows\System\rvgazMg.exe
  2⤵
  PID:8440
- C:\Windows\System\GzJAaYF.exe
  C:\Windows\System\GzJAaYF.exe
  2⤵
  PID:8456
- C:\Windows\System\PNqIHeS.exe
  C:\Windows\System\PNqIHeS.exe
  2⤵
  PID:8472
- C:\Windows\System\muxBfrS.exe
  C:\Windows\System\muxBfrS.exe
  2⤵
  PID:8488
- C:\Windows\System\kdLeDQx.exe
  C:\Windows\System\kdLeDQx.exe
  2⤵
  PID:8504
- C:\Windows\System\XapOBSO.exe
  C:\Windows\System\XapOBSO.exe
  2⤵
  PID:8644
- C:\Windows\System\EqUhPyC.exe
  C:\Windows\System\EqUhPyC.exe
  2⤵
  PID:8572
- C:\Windows\System\TVCmxeo.exe
  C:\Windows\System\TVCmxeo.exe
  2⤵
  PID:8588
- C:\Windows\System\XMPwWJG.exe
  C:\Windows\System\XMPwWJG.exe
  2⤵
  PID:8584
- C:\Windows\System\fHbGfvm.exe
  C:\Windows\System\fHbGfvm.exe
  2⤵
  PID:8660
- C:\Windows\System\anGiKiM.exe
  C:\Windows\System\anGiKiM.exe
  2⤵
  PID:8728
- C:\Windows\System\agcIbIX.exe
  C:\Windows\System\agcIbIX.exe
  2⤵
  PID:8792
- C:\Windows\System\yZItVkJ.exe
  C:\Windows\System\yZItVkJ.exe
  2⤵
  PID:8712
- C:\Windows\System\jxHoufI.exe
  C:\Windows\System\jxHoufI.exe
  2⤵
  PID:8780
- C:\Windows\System\BThAYpe.exe
  C:\Windows\System\BThAYpe.exe
  2⤵
  PID:8892
- C:\Windows\System\CIODKGw.exe
  C:\Windows\System\CIODKGw.exe
  2⤵
  PID:8808
- C:\Windows\System\SXrRhje.exe
  C:\Windows\System\SXrRhje.exe
  2⤵
  PID:8844
- C:\Windows\System\NMnAbrO.exe
  C:\Windows\System\NMnAbrO.exe
  2⤵
  PID:8840
- C:\Windows\System\kXGEAOS.exe
  C:\Windows\System\kXGEAOS.exe
  2⤵
  PID:8936
- C:\Windows\System\aOktyCN.exe
  C:\Windows\System\aOktyCN.exe
  2⤵
  PID:8988
- C:\Windows\System\gSnIsRh.exe
  C:\Windows\System\gSnIsRh.exe
  2⤵
  PID:9004
- C:\Windows\System\ejgwNbg.exe
  C:\Windows\System\ejgwNbg.exe
  2⤵
  PID:9020
- C:\Windows\System\OBnFuGY.exe
  C:\Windows\System\OBnFuGY.exe
  2⤵
  PID:9036
- C:\Windows\System\ITgMUXP.exe
  C:\Windows\System\ITgMUXP.exe
  2⤵
  PID:9052
- C:\Windows\System\RSNBCfu.exe
  C:\Windows\System\RSNBCfu.exe
  2⤵
  PID:9060
- C:\Windows\System\COeoulc.exe
  C:\Windows\System\COeoulc.exe
  2⤵
  PID:9132
- C:\Windows\System\opHqiRs.exe
  C:\Windows\System\opHqiRs.exe
  2⤵
  PID:9196
- C:\Windows\System\aQujrTl.exe
  C:\Windows\System\aQujrTl.exe
  2⤵
  PID:9084
- C:\Windows\System\sulKPbt.exe
  C:\Windows\System\sulKPbt.exe
  2⤵
  PID:9180
- C:\Windows\System\gNsqjdl.exe
  C:\Windows\System\gNsqjdl.exe
  2⤵
  PID:9116
- C:\Windows\System\XtaWQXi.exe
  C:\Windows\System\XtaWQXi.exe
  2⤵
  PID:8264
- C:\Windows\System\LpbVjKA.exe
  C:\Windows\System\LpbVjKA.exe
  2⤵
  PID:8452
- C:\Windows\System\QojirPP.exe
  C:\Windows\System\QojirPP.exe
  2⤵
  PID:8412
- C:\Windows\System\trcIXjq.exe
  C:\Windows\System\trcIXjq.exe
  2⤵
  PID:8648
- C:\Windows\System\oZNYtKd.exe
  C:\Windows\System\oZNYtKd.exe
  2⤵
  PID:8628
- C:\Windows\System\jLpEcof.exe
  C:\Windows\System\jLpEcof.exe
  2⤵
  PID:8776
- C:\Windows\System\ZYMwIis.exe
  C:\Windows\System\ZYMwIis.exe
  2⤵
  PID:8964
- C:\Windows\System\cJmOhxn.exe
  C:\Windows\System\cJmOhxn.exe
  2⤵
  PID:9016
- C:\Windows\System\HtRBoGJ.exe
  C:\Windows\System\HtRBoGJ.exe
  2⤵
  PID:8316
- C:\Windows\System\kizafWl.exe
  C:\Windows\System\kizafWl.exe
  2⤵
  PID:8364
- C:\Windows\System\NNYYyCX.exe
  C:\Windows\System\NNYYyCX.exe
  2⤵
  PID:2768
- C:\Windows\System\HvGkeHy.exe
  C:\Windows\System\HvGkeHy.exe
  2⤵
  PID:8468
- C:\Windows\System\fBMCYnC.exe
  C:\Windows\System\fBMCYnC.exe
  2⤵
  PID:8604
- C:\Windows\System\bfKLwLZ.exe
  C:\Windows\System\bfKLwLZ.exe
  2⤵
  PID:8692
- C:\Windows\System\xYLApvi.exe
  C:\Windows\System\xYLApvi.exe
  2⤵
  PID:8856
- C:\Windows\System\zPDDUgN.exe
  C:\Windows\System\zPDDUgN.exe
  2⤵
  PID:8872
- C:\Windows\System\jbUWyis.exe
  C:\Windows\System\jbUWyis.exe
  2⤵
  PID:9028
- C:\Windows\System\jupQclL.exe
  C:\Windows\System\jupQclL.exe
  2⤵
  PID:9064
- C:\Windows\System\icsedyj.exe
  C:\Windows\System\icsedyj.exe
  2⤵
  PID:9176
- C:\Windows\System\jEQuZYK.exe
  C:\Windows\System\jEQuZYK.exe
  2⤵
  PID:8980
- C:\Windows\System\VLfZMTk.exe
  C:\Windows\System\VLfZMTk.exe
  2⤵
  PID:9212
- C:\Windows\System\yhmZfKN.exe
  C:\Windows\System\yhmZfKN.exe
  2⤵
  PID:9048
- C:\Windows\System\ydNclFu.exe
  C:\Windows\System\ydNclFu.exe
  2⤵
  PID:9128
- C:\Windows\System\lOCAOjq.exe
  C:\Windows\System\lOCAOjq.exe
  2⤵
  PID:9228
- C:\Windows\System\kNEVZYL.exe
  C:\Windows\System\kNEVZYL.exe
  2⤵
  PID:9244
- C:\Windows\System\MRnsAFK.exe
  C:\Windows\System\MRnsAFK.exe
  2⤵
  PID:9260
- C:\Windows\System\QuxThUL.exe
  C:\Windows\System\QuxThUL.exe
  2⤵
  PID:9276
- C:\Windows\System\jqyPEWs.exe
  C:\Windows\System\jqyPEWs.exe
  2⤵
  PID:9292
- C:\Windows\System\JbzCePp.exe
  C:\Windows\System\JbzCePp.exe
  2⤵
  PID:9308
- C:\Windows\System\ZPHlxAa.exe
  C:\Windows\System\ZPHlxAa.exe
  2⤵
  PID:9324
- C:\Windows\System\HgCVirj.exe
  C:\Windows\System\HgCVirj.exe
  2⤵
  PID:9344
- C:\Windows\System\iUaqxkq.exe
  C:\Windows\System\iUaqxkq.exe
  2⤵
  PID:9360
- C:\Windows\System\veTEiLH.exe
  C:\Windows\System\veTEiLH.exe
  2⤵
  PID:9376
- C:\Windows\System\uwGglTQ.exe
  C:\Windows\System\uwGglTQ.exe
  2⤵
  PID:9392
- C:\Windows\System\SbwNvKd.exe
  C:\Windows\System\SbwNvKd.exe
  2⤵
  PID:9408
- C:\Windows\System\QGYUxwt.exe
  C:\Windows\System\QGYUxwt.exe
  2⤵
  PID:9424
- C:\Windows\System\dDOrQqO.exe
  C:\Windows\System\dDOrQqO.exe
  2⤵
  PID:9440
- C:\Windows\System\xIDESQL.exe
  C:\Windows\System\xIDESQL.exe
  2⤵
  PID:9456
- C:\Windows\System\yzKaPOV.exe
  C:\Windows\System\yzKaPOV.exe
  2⤵
  PID:9480
- C:\Windows\System\taVlCtP.exe
  C:\Windows\System\taVlCtP.exe
  2⤵
  PID:9500
- C:\Windows\System\ancCtTy.exe
  C:\Windows\System\ancCtTy.exe
  2⤵
  PID:9516
- C:\Windows\System\NadhvSQ.exe
  C:\Windows\System\NadhvSQ.exe
  2⤵
  PID:9532
- C:\Windows\System\UDycmDF.exe
  C:\Windows\System\UDycmDF.exe
  2⤵
  PID:9552
- C:\Windows\System\DNmUJgP.exe
  C:\Windows\System\DNmUJgP.exe
  2⤵
  PID:9568
- C:\Windows\System\ynoSIqn.exe
  C:\Windows\System\ynoSIqn.exe
  2⤵
  PID:9584
- C:\Windows\System\qywkwnX.exe
  C:\Windows\System\qywkwnX.exe
  2⤵
  PID:9600
- C:\Windows\System\sgIyyVs.exe
  C:\Windows\System\sgIyyVs.exe
  2⤵
  PID:9616
- C:\Windows\System\jORCOUi.exe
  C:\Windows\System\jORCOUi.exe
  2⤵
  PID:9632
- C:\Windows\System\uTIshbt.exe
  C:\Windows\System\uTIshbt.exe
  2⤵
  PID:9648
- C:\Windows\System\JnflDKe.exe
  C:\Windows\System\JnflDKe.exe
  2⤵
  PID:9664
- C:\Windows\System\QYAuAII.exe
  C:\Windows\System\QYAuAII.exe
  2⤵
  PID:9680
- C:\Windows\System\jiamxlu.exe
  C:\Windows\System\jiamxlu.exe
  2⤵
  PID:9696
- C:\Windows\System\wrYygfq.exe
  C:\Windows\System\wrYygfq.exe
  2⤵
  PID:9712
- C:\Windows\System\EVhrwLe.exe
  C:\Windows\System\EVhrwLe.exe
  2⤵
  PID:9736
- C:\Windows\System\XfbbYVg.exe
  C:\Windows\System\XfbbYVg.exe
  2⤵
  PID:9752
- C:\Windows\System\wRZEWGd.exe
  C:\Windows\System\wRZEWGd.exe
  2⤵
  PID:9768
- C:\Windows\System\cSxHKyv.exe
  C:\Windows\System\cSxHKyv.exe
  2⤵
  PID:9784
- C:\Windows\System\AXiVkJq.exe
  C:\Windows\System\AXiVkJq.exe
  2⤵
  PID:9800
- C:\Windows\System\QtQstHy.exe
  C:\Windows\System\QtQstHy.exe
  2⤵
  PID:9816
- C:\Windows\System\EyFMPyI.exe
  C:\Windows\System\EyFMPyI.exe
  2⤵
  PID:9832
- C:\Windows\System\Wacvbgn.exe
  C:\Windows\System\Wacvbgn.exe
  2⤵
  PID:9848
- C:\Windows\System\IxauYnl.exe
  C:\Windows\System\IxauYnl.exe
  2⤵
  PID:9864
- C:\Windows\System\ZEzmUmx.exe
  C:\Windows\System\ZEzmUmx.exe
  2⤵
  PID:9880
- C:\Windows\System\GyCEWlb.exe
  C:\Windows\System\GyCEWlb.exe
  2⤵
  PID:9896
- C:\Windows\System\SKIRsYV.exe
  C:\Windows\System\SKIRsYV.exe
  2⤵
  PID:9912
- C:\Windows\System\ZMHgDst.exe
  C:\Windows\System\ZMHgDst.exe
  2⤵
  PID:9928
- C:\Windows\System\cJLroaA.exe
  C:\Windows\System\cJLroaA.exe
  2⤵
  PID:9944
- C:\Windows\System\cRBfHkt.exe
  C:\Windows\System\cRBfHkt.exe
  2⤵
  PID:9960
- C:\Windows\System\DGcUdiy.exe
  C:\Windows\System\DGcUdiy.exe
  2⤵
  PID:9976
- C:\Windows\System\cNXxLsh.exe
  C:\Windows\System\cNXxLsh.exe
  2⤵
  PID:9992
- C:\Windows\System\FqTBDGW.exe
  C:\Windows\System\FqTBDGW.exe
  2⤵
  PID:10008
- C:\Windows\System\rlqqTFI.exe
  C:\Windows\System\rlqqTFI.exe
  2⤵
  PID:10024
- C:\Windows\System\YJYqPPR.exe
  C:\Windows\System\YJYqPPR.exe
  2⤵
  PID:10040
- C:\Windows\System\PfKpsQt.exe
  C:\Windows\System\PfKpsQt.exe
  2⤵
  PID:10056
- C:\Windows\System\ROZeyCJ.exe
  C:\Windows\System\ROZeyCJ.exe
  2⤵
  PID:10072
- C:\Windows\System\mmSYsuM.exe
  C:\Windows\System\mmSYsuM.exe
  2⤵
  PID:10088
- C:\Windows\System\KsXtqyb.exe
  C:\Windows\System\KsXtqyb.exe
  2⤵
  PID:10104
- C:\Windows\System\uXJHTSR.exe
  C:\Windows\System\uXJHTSR.exe
  2⤵
  PID:10120
- C:\Windows\System\jTHxPFI.exe
  C:\Windows\System\jTHxPFI.exe
  2⤵
  PID:10136
- C:\Windows\System\OuTroAO.exe
  C:\Windows\System\OuTroAO.exe
  2⤵
  PID:10152
- C:\Windows\System\XsLkKqt.exe
  C:\Windows\System\XsLkKqt.exe
  2⤵
  PID:10168
- C:\Windows\System\ZvLeBwD.exe
  C:\Windows\System\ZvLeBwD.exe
  2⤵
  PID:10184
- C:\Windows\System\BphDjBe.exe
  C:\Windows\System\BphDjBe.exe
  2⤵
  PID:10200
- C:\Windows\System\RSKkAye.exe
  C:\Windows\System\RSKkAye.exe
  2⤵
  PID:10216
- C:\Windows\System\KnxYWdU.exe
  C:\Windows\System\KnxYWdU.exe
  2⤵
  PID:10232
- C:\Windows\System\htUfpmA.exe
  C:\Windows\System\htUfpmA.exe
  2⤵
  PID:9000
- C:\Windows\System\zTmZUjS.exe
  C:\Windows\System\zTmZUjS.exe
  2⤵
  PID:8092
- C:\Windows\System\dXPRQXJ.exe
  C:\Windows\System\dXPRQXJ.exe
  2⤵
  PID:9240
- C:\Windows\System\ntRTqYG.exe
  C:\Windows\System\ntRTqYG.exe
  2⤵
  PID:8252
- C:\Windows\System\apFLzwu.exe
  C:\Windows\System\apFLzwu.exe
  2⤵
  PID:9336
- C:\Windows\System\GnmZAPF.exe
  C:\Windows\System\GnmZAPF.exe
  2⤵
  PID:9404
- C:\Windows\System\fCJFQhW.exe
  C:\Windows\System\fCJFQhW.exe
  2⤵
  PID:9472
- C:\Windows\System\HdmxbkS.exe
  C:\Windows\System\HdmxbkS.exe
  2⤵
  PID:8748
- C:\Windows\System\vaWLfhn.exe
  C:\Windows\System\vaWLfhn.exe
  2⤵
  PID:8280
- C:\Windows\System\EBnpoFa.exe
  C:\Windows\System\EBnpoFa.exe
  2⤵
  PID:9012
- C:\Windows\System\gMZqEnP.exe
  C:\Windows\System\gMZqEnP.exe
  2⤵
  PID:8464
- C:\Windows\System\dtmAVGE.exe
  C:\Windows\System\dtmAVGE.exe
  2⤵
  PID:9032
- C:\Windows\System\TxUlGFo.exe
  C:\Windows\System\TxUlGFo.exe
  2⤵
  PID:8828
- C:\Windows\System\PEEmDGf.exe
  C:\Windows\System\PEEmDGf.exe
  2⤵
  PID:9252
- C:\Windows\System\XgYqFZU.exe
  C:\Windows\System\XgYqFZU.exe
  2⤵
  PID:9316
- C:\Windows\System\qIMzvnU.exe
  C:\Windows\System\qIMzvnU.exe
  2⤵
  PID:9384
- C:\Windows\System\ZTafQCb.exe
  C:\Windows\System\ZTafQCb.exe
  2⤵
  PID:9448
- C:\Windows\System\FevphUF.exe
  C:\Windows\System\FevphUF.exe
  2⤵
  PID:9508
- C:\Windows\System\OXlZyCU.exe
  C:\Windows\System\OXlZyCU.exe
  2⤵
  PID:9548
- C:\Windows\System\jWZaOMe.exe
  C:\Windows\System\jWZaOMe.exe
  2⤵
  PID:9640
- C:\Windows\System\SrUMull.exe
  C:\Windows\System\SrUMull.exe
  2⤵
  PID:9676
- C:\Windows\System\PRlNreS.exe
  C:\Windows\System\PRlNreS.exe
  2⤵
  PID:9496
- C:\Windows\System\oRuKSBG.exe
  C:\Windows\System\oRuKSBG.exe
  2⤵
  PID:9564
- C:\Windows\System\kvxQuEn.exe
  C:\Windows\System\kvxQuEn.exe
  2⤵
  PID:9628
- C:\Windows\System\ZixHIiq.exe
  C:\Windows\System\ZixHIiq.exe
  2⤵
  PID:9692
- C:\Windows\System\mxbnVuq.exe
  C:\Windows\System\mxbnVuq.exe
  2⤵
  PID:9724
- C:\Windows\System\VvmZCQm.exe
  C:\Windows\System\VvmZCQm.exe
  2⤵
  PID:9796
- C:\Windows\System\JFkwRYI.exe
  C:\Windows\System\JFkwRYI.exe
  2⤵
  PID:9744
- C:\Windows\System\zSStdks.exe
  C:\Windows\System\zSStdks.exe
  2⤵
  PID:9808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CmwhyiV.exe

Filesize
2.1MB

MD5
1f12dc9804f623abd929e408b6bb66b7

SHA1
33eeb48beec3577f2d7a89e2d8f3209beaf88fc9

SHA256
bd7891ca5de367ec33791b6c042fb3f080fef95b6c2ddae11ce9cfda401be6c7

SHA512
e4c8748cd3b4bdd6f9700a1be873c66cc77bb8d54e92b3178d8f8cfe84b1f2ec055d497a9708a01fd0125519d1c271c5e8949b180a76e241e7ef7ea067510dea

Download Submit
C:\Windows\system\DIgFFCS.exe

Filesize
2.1MB

MD5
745f735e150164c005e698153e598a6c

SHA1
ecbf675cc876f9c4b1a54057d517b843182f2bed

SHA256
2dee4607bb5cc62be7df4bd40416432780049df17a89a4790872991fbb1c5068

SHA512
f5e72f2122c8ca711e8fe79cf3d4dd32adeafadd6e0dba9704bf532fb8a9eee771d28eceebfcf3093610835337ad42c1ed24b0b857c293b5682c0ac7a66ebef5

Download Submit
C:\Windows\system\FCelPzX.exe

Filesize
2.1MB

MD5
66c24199a9dbaa5effec8d5ab547ea1c

SHA1
ced7546a78ad8edb9370af4c1aa221a94303a7e3

SHA256
065dd50adf4c4b84a801fc7af200b1b211d1f16e36d681acd6240e2595bf252a

SHA512
cca1b3f6af26420275a8ea9e37dcbd92c9c0fa1c1f2b55d164a8cc7336067db7d59c00c11b9274444e26b24519c93d7a0b25dc28806e0f24399cbf4e2c5f5c24

Download Submit
C:\Windows\system\GkSszJq.exe

Filesize
2.1MB

MD5
fbcb1b93c64a03e3ccf225ab7ad2510e

SHA1
3d90d6e4484fe56f9e212076f6e490fc5dfb1d0e

SHA256
64c749005f59a274b53cb799835693ce81be4b75988aafa07be867d3c0b7872b

SHA512
59dcb7ffeed7aff272558e927c036a534d91ae223dfda50160b677932ac9ed0529efbfb4e022f84e449207da271e1471763be45157821219199dcc46ab8632a0

Download Submit
C:\Windows\system\HocZZmc.exe

Filesize
2.1MB

MD5
7f3352753321167da4ec47795d9bbf3e

SHA1
242cdc5fbcb1438cbd0311022ec24721a86fa950

SHA256
ec37f1395b8b4af6bea970199732e06bc5583ad2e332a1f27f50e2d452d4b8a7

SHA512
a647b94e44bf54a393c5366ba1a7ed1237623abd79c9f2515c4ea452df912519d9b9d02f30a37a022bc5e7ccee63221db1f878476da08c14488138a7b6edf0d7

Download Submit
C:\Windows\system\KAFZSZz.exe

Filesize
2.1MB

MD5
18360958348e394241741aad2a35f1af

SHA1
0c34c760745ba6f54dc16bd9fdeb751e707472c9

SHA256
b205430e64953a48a9cb10b05b3ab8dfa0cef0693d542ba63b311053e01c7d36

SHA512
0274422ac1921c61b01572304feb4cdc1e4fb3ddb67089ea40769c055297d003904eb02bf18ebc69b05d9a86da7527e87c587abe3c855a2758abe25e9c3d8f7d

Download Submit
C:\Windows\system\LVARyKx.exe

Filesize
2.1MB

MD5
eeb7a60f6234f3d510b476ded751c7b1

SHA1
289a5b3ca5f2e9f01b6fa44ffae08b7fe4047ed9

SHA256
ddd7b9459b1a19fee059ebe418a4e74a6a17e16f4f931e39909cf374b0c712e3

SHA512
79645cd01a65dc9820b57cacc8ddd3a6e3c68f54e643073572f93aaa8ffd57ace6a2f5a550fac04b0eb6dc7c7ebb29d0fff1add98c32f7d0e98665a8eca292e1

Download Submit
C:\Windows\system\MPkRtGt.exe

Filesize
2.1MB

MD5
5e8d1980a44856290be8b1bd6d18fb22

SHA1
9c83bf0602c33e04833735a659bc9e5aeadbaece

SHA256
e6c2f9e5048a489fec8bc3a0eea856e535c0d3423613766e2857fb0754742324

SHA512
9cd4bf5633acead9869c085e5e2e30e2d0ea45d0a16d99f3c68bf03b3d7af56cf0dda0c328a465b1bab9adc38e52746106205ff0c8942e1dadce2aaddba7997b

Download Submit
C:\Windows\system\NhKiBHK.exe

Filesize
2.1MB

MD5
18429f0e60d1a234f89eab738066918c

SHA1
e3fcca799dd867ecdd6828fa11377a957f1f8a85

SHA256
77b245e481027e8b00d5217563f7fafd73c57f37f61aa0a51805b7c5660ecd9d

SHA512
94aae26b3e17375bce1599897d119937831bd8d53e61cd3ae7a250e8a307535343471d8c178bdd06ef14d10e0c00be2d5bc882259cb21ad9e804fe5a816974ea

Download Submit
C:\Windows\system\PfKLjRb.exe

Filesize
2.1MB

MD5
245860a3e544004072a9169a135fdb56

SHA1
f62888f61bf25a57c21e31c96ae98e2e226cb852

SHA256
b81d76d05c72545b76cc189c4859c56f377f113f86bab3d5d9e5c61f7bef684c

SHA512
e3575e4860e927209dcc0b134ebd7be1e0922583935723c3959a1ce458c51ea51d08e6d7175cde7427ceb2414cb46a936a62be6cf5ba6e3f142355c21ecd9e3d

Download Submit
C:\Windows\system\QudJVkH.exe

Filesize
2.1MB

MD5
b3f3a2fa7dcbd3669e4b4b25f172c02d

SHA1
da6d41bee27b3cf2cd0dd0b460a0f47c03c3fbed

SHA256
d5d56c0064c643d4b88847723c1f6bba0930995e516cdac4de1e5f0c76f08f49

SHA512
93a5a13e037ca5f03fb1f80d5c481872fee109798d6be59ad51158c6e893ce3ebd5b2dd92e1728acd7cfe36700d84bba0fc51da66ed2a46b12a408c0ffb26ba1

Download Submit
C:\Windows\system\SzYHYqT.exe

Filesize
2.1MB

MD5
ed063346e3f13fd22701edd2db0bc104

SHA1
6d55bc459e1af9e5a21f8ddff3854414dae0595e

SHA256
e7997e03a536d27273bceda4c83b638252ff0fc6e5dc171de6346164e3b0549e

SHA512
f0238bd0709f868bcc3c6dd3438b3c6d90b397b0abd9bac967545a465f4853eb54b64cf75e191cc8cb965e78cd9bce3e7e28a147f885b7bc78c3c43bb06b097a

Download Submit
C:\Windows\system\ULWuBhr.exe

Filesize
2.1MB

MD5
dbaeda15014f4dd21a2841999df0767d

SHA1
894175bc07bef7fb1790cc69a848ddc847d65025

SHA256
2cc25921c341ab3513918477d37ef01eef63a5df7319ca01286979cf024b764b

SHA512
6f6162c337ffdc7dc9d5a4801e8518b68e8ba7cca8c9fcc65072270c95db122f4ec360b8572b7d7e195dfcfa99a4f31a5410b08639b5244bcaa91ba90e1b8a49

Download Submit
C:\Windows\system\YmaRPEN.exe

Filesize
2.1MB

MD5
6af228df68a7d15faca7568774f5aee0

SHA1
44e6c8ed8ffedc4876826ed61d6676401d6d6b04

SHA256
04bca578e3a4460c44b43c4bc42f9fb49c92f5aad5f427a2ddb9deb31efdb84c

SHA512
7f73553ec07e7973aa4086d2227a360bda52eec16a39a3908b5a508af6a91078c2936ed709845aaec5009d04aec735d42bd6161addd1126210e8f48dd11ced5e

Download Submit
C:\Windows\system\ZRZAWuz.exe

Filesize
2.1MB

MD5
9bf522153a8b71a7a38358b6cb92fb07

SHA1
c35e9e1f3d59d5f6d2e9d301d8efd19f53315f67

SHA256
6a81df64aa855c0f9a7e66e77b657a376d746ea8421805630e0737a47809904c

SHA512
9620fa56bb37882fba7fe1e43413759641145eadbc415cc748dfc6ea4bdaf080dabb53322be457213f273d3dc9e7940c17ac1d599d553f22e10b42e3b5e0854d

Download Submit
C:\Windows\system\ZiSUaEm.exe

Filesize
2.1MB

MD5
f591c3dd214759f6ad04569ff9eb3be0

SHA1
47b1d6c5c8a0c2f635f22473e104470a5146f4a6

SHA256
ca102fef72d6be450fcae2d2dbe6cadacf972f583195142f6544a04a03b379e1

SHA512
f5db721c34c110c96b99faf34b9d00191735f444743fc3b4cf9c8f316a6568c548a2b91f96713889ddf862ae9fd9970f8a9ddfabf4a79ba4fb7c0750f3ebde67

Download Submit
C:\Windows\system\damGbBI.exe

Filesize
2.1MB

MD5
b1fd9a223fd066f85fecb5fcb60a0ca4

SHA1
4fe78d51e72ee61a07cfa16abb0adc30209a1bfe

SHA256
3d0233fd454fe492164e810f2922eda6cde00adea33f308a01044b814d473154

SHA512
94135b2c6bf70a877ba8decba1ebe72405fc664782e2ed55a07d0e5e61cb2706c3b513cfd7c8ce6cedb9342c30c2591a4a1ac6d9840181cbf44119ebf783d559

Download Submit
C:\Windows\system\fsdBjvU.exe

Filesize
2.1MB

MD5
354e75b237515255e3017c6efc311d14

SHA1
641e7b5992641a986b660abc1c539befc0ecec8a

SHA256
107d38881ea5c9d4c3c91a286f99f98016f74c57cb57496a53d29632fddda8de

SHA512
a6559e3dd40e7b512c718804ac2d0492084d609520f53571f46c1cab407cf7ecb093135751e9a97578a8706b92cdcfe6b19ffb70e91049dc496c951052f273d6

Download Submit
C:\Windows\system\iqVIvMt.exe

Filesize
2.1MB

MD5
7663851d542717486b922a7ff89a0edb

SHA1
7b438a58b25351ea241f2894386af41785872ba7

SHA256
e7c98925dee73bc7d7763d442f2b96d5c260d33ecf9eaef770d3eefd0539a76d

SHA512
e067db2ecb1c4dc38f7a8136acd99ed1687dcc58cc2bac4e2a2937bf4d88c631f87d3fc9769d58a26a69d541e294975c39b37ef40eb8f373f59629c7d52bb423

Download Submit
C:\Windows\system\irEAiBT.exe

Filesize
2.1MB

MD5
c6f590f85fce3717669c1fd853c395f5

SHA1
e2dda9cf6615cf64814427a4af51bad2b4c2f3f1

SHA256
7ac224c89fdf7614f70dbbb89887b7644afeb80aae8f13cdb6e59593548d32fe

SHA512
5587b8bbb4b9aac77dfd5aae47261a7ee224a5be94b93c2fe1d3f14c47d5c604bd3fe738d874913bb41df007d1ac02f4e5583128b1136e102ad15157e0d344f2

Download Submit
C:\Windows\system\jaHKkcU.exe

Filesize
2.1MB

MD5
cf1c9c47201dba498c69f063b64f4a43

SHA1
fd17e20a89a143736babb905c62c6948eb588897

SHA256
f49981ca72e33b47d89601ecf4f3b825e26fcc0322c6ed8f60b63b601cf56875

SHA512
e30e5b47e56c7d20f580187847ab127e9e8731c320f68191fe1cbef2456a4dc28f5111466232479b1dcdb1ede304b8ae5f3e6a66720b4cc6b1e887a8671fe906

Download Submit
C:\Windows\system\lgLHXER.exe

Filesize
2.1MB

MD5
323816ff8d66c8fb76be78122a5c6929

SHA1
ba1f5f8e3e6b7a40e547272bc9d4a2ce0cc228af

SHA256
f6fe0e13fe0eee79101b546cab8cb6795bea3692298352be87068c5901f446f4

SHA512
b97ea38f373fe08d26f2b90f01b1f5193c491aaf30accd0a597913ba543c0b68c3536b3d9ca08dfb7869bf4d426cfa879777c0ab428f3e27c39a7130535147c1

Download Submit
C:\Windows\system\muJjsIi.exe

Filesize
2.1MB

MD5
e250239a1237465be0aef7738ed25701

SHA1
dfbb65dd385da654f243ff1193ccfb647ff1645d

SHA256
48f6b2a270b83cc83bf43f7a7b7362ab592f63d43f372c22186bef51e718c5a5

SHA512
571153af5721639ba03038fba87eec7fa5fb7b9d861ead970d6639cf425a88e1e9fbc514f5dd8872428ce14819e3a5a89f673a23fedabd12f24dc9b7073d9fcc

Download Submit
C:\Windows\system\rAswcAz.exe

Filesize
2.1MB

MD5
e549965d6435024b85d06ea18cd22952

SHA1
a2731435520c89428fe570780bd00b1dc22467fa

SHA256
4503b30df428946ee1e9537fab4ebc9de878dc9f7fdec5b8bf88f474a796fe5a

SHA512
835fccf05f1aac9801951e717299b1a56739f1a74cc4e5964173adcc4f57f5d6b5e89e73017b2d906d7370a50f697d8043e49120476acde6ad6f014659628d3c

Download Submit
C:\Windows\system\rHEbbMp.exe

Filesize
2.1MB

MD5
08b7465939b8ddc4f9c1efb7fdc89f40

SHA1
67b7c94e20c8503a840360390524a14534527eb7

SHA256
93f4ccf8f14c652a158b790d34895784012c526338291fa290056be4c456427f

SHA512
603e8af32e7fd7b5f417b60c5277b898d1196f8d7e7aa9e7aa05359a6c588ccb4bf0bd82f1fd84eeec2f63261478cb4d014d85568fdb907c5163c3af59dc5933

Download Submit
C:\Windows\system\sjMBicx.exe

Filesize
8B

MD5
56dfc2f514c29abc0f7637c9a955b7d2

SHA1
ae4f9772e45bb1dee2f545529ca3e5d6bdd4dd65

SHA256
d458636957a00bb0d8a9759a3052bcc3b71650d32d60b24077d53884f0b19279

SHA512
cb24ecc705f756ecdc58fd78c8b8a6aa84beaf9becae76712e53e91e62d5881964bb4ebaee88647166240726139e4de421aa46f8ca7ebc7aaa10589a7d82f3d7

Download Submit
C:\Windows\system\tYdbzEw.exe

Filesize
2.1MB

MD5
5bd4ecbddbe43fed07bc225615258f47

SHA1
94079e20949deb70a864a8b71e60b0903a8fbd78

SHA256
f364f3c55f2129a04df6cbe5de60a4c921f49716114e5fb60777ec794d6a9c9c

SHA512
6c42336c7ca67a396129858bcc41b7489a70096c4aa208350edd83f5fdf0710291a6650cd8d46afa96fe7e7a6abfeaca3c43a85d3ae9240b20dfe03a64f2b56d

Download Submit
C:\Windows\system\yVvJHBE.exe

Filesize
2.1MB

MD5
3c8265ae00e1f6830eb5143241c2facc

SHA1
a3ea117d1e79d5ccb41f7dd36a433731fb074eec

SHA256
f90ea0b6675783a381b45565b890c7e5934c23ed21b4cb8a181e99584ee758f3

SHA512
606ae8bf6477b1a87fee4111bd6ceb232971a0f50fd68740b1ba61548e71e87206adf5096a657b94de79f309b9de9e51d72da9b2939ee98d3907065c2f573b0d

Download Submit
\Windows\system\BzlIFMd.exe

Filesize
2.1MB

MD5
31ae3540e3e3445e16e19255376c5f5f

SHA1
ad9b28cd42a857dbe473351cd53c0b6c62db61fd

SHA256
04ddc8439878814fac5b36caabdc618fccb1c769ec0afcdaaa116121b69d71a1

SHA512
7857cc02188faf0927143615cb7faac0beef3163c31ed84279568e49c1eb916f1108321fefa7cd90bf39eca4f1e287a2bfb3f952949655c360efbdc82c125aa5

Download Submit
\Windows\system\JUnSFNx.exe

Filesize
2.1MB

MD5
b77b8b6f4a3b5837a11c1a4caa1bb219

SHA1
a8f40053e846f164762976105239e3147b60c8b1

SHA256
bd92689681dac18e694b25afe32cdb0f9ce19e94976433ed68275be42c6fb8e0

SHA512
8e2f554b052c0c57640bae25d96b2a0bf030b9ac99e543566ea195e283328023e3e427c102a49fe40dfb3cd136b823780db6c2314f4a20297245a5eff865c250

Download Submit
\Windows\system\qhJEwkB.exe

Filesize
2.1MB

MD5
124c07561aaba90c2056d897c530fee4

SHA1
712981ec674a1e358178c782aa76031469367726

SHA256
5d9e0aa7e8faac7c1f0ac0510d34b1066de9fe50e7b9830e5c04185c0a332e7c

SHA512
8481e648db6a23b77c21cc1cf91be64e15e32c76fceb70adf16b8df9411aceae5398187c20a14ca537607238348a33d5438fe35d008e547991b9c7cd935e6673

Download Submit
\Windows\system\urxoQon.exe

Filesize
2.1MB

MD5
f1ea793cf8823837c2a81780ce52cfa8

SHA1
a7dba4a8d6a7884d62154aaf7f448fd8a61ab5aa

SHA256
47cd248647e30c916164c39914c88597a60a1567fb2ea32aa84c48d09b4c0631

SHA512
6827d8f05dc1a5d4b38a27e40058cac35d3c292f555f22ec918a5220e36bc2eba3887c62019cabe2a5102a06978f08fbf131ab9759219b5abe7728ee7c216f62

Download Submit
\Windows\system\xzOQDBa.exe

Filesize
2.1MB

MD5
2bf2fa5bd2d2da2f89623abe77dce816

SHA1
70f15b03a840021f1e52067db0499b3cd620d098

SHA256
1699e729c47115476234e565aca245715a7536b5a0f64d13f583a7ce1d6d0399

SHA512
ae4bf73dcc7623ecdffc7186e5ade87128a50135085c969923f8fd71a497daf0582d8a9ddeaf774a63f582a6d8b2defcc5622961456cbb36c80fa7ce36587d25

Download Submit
memory/1956-4692-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/1956-8-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2456-70-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2456-71-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2460-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2460-13172-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-96-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2460-97-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-94-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-93-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-13171-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-75-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2460-42-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-26-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2460-15-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-2-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2460-46-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-92-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-7385-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2460-77-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-78-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2568-63-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-6706-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-6726-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-95-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-6708-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-69-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-6707-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2728-40-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2764-6723-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-91-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-6705-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2808-84-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2948-6725-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-54-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-6729-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/3028-79-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download