xmrig | a957c302b82876a6c2337c6e2a227767c3d84f50d9309ebb3f748d70ad1c2b6f

Analysis

max time kernel
146s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
Size

1.5MB
MD5

34438f512883f426da25337a09dfa26d
SHA1

2512420053d07ecce9b37ceb5eebc1e8bf3100d7
SHA256

a957c302b82876a6c2337c6e2a227767c3d84f50d9309ebb3f748d70ad1c2b6f
SHA512

858e03a1a249108c2e8096a44e0c70ce946e6d9d779a266010491fe435f8ac3af8bd98b10420a62bc173e68635d90834035f270e3a4ea6af4f4957c7bd9603bb
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwmvcBH:Lz071uv4BPMkibTIA5CJv6

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2836-120-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2124-128-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2376-127-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2676-105-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2504-92-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2396-110-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2196-108-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/3032-124-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/392-122-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2472-114-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2404-100-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2668-90-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2676-1759-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2504-1761-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2396-1782-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2196-1766-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2668-1765-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2404-1764-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2124-1763-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2836-2724-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/392-2723-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/3032-2789-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2376-2795-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2472-2783-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2248	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2124	TlmNTea.exe
2668	bqJcaXs.exe
2504	CEndIBq.exe
2404	KvjvtZc.exe
2676	NIxTXNF.exe
2196	LqsjoZi.exe
2396	jorHlub.exe
2472	hPeBSUr.exe
2836	oQaoUAZ.exe
392	VatvTiI.exe
3032	Effwbvo.exe
2376	JXaakuk.exe
1660	LOMxyur.exe
840	LfgYIBs.exe
1592	bEJpDQl.exe
2496	fseGfBe.exe
2148	zdGFthS.exe
2688	guFpBNv.exe
1964	ClYoLmH.exe
1092	oMclQrY.exe
1656	XMqtrph.exe
1296	BGKPIEB.exe
2200	fkvZFjt.exe
2728	NWwNDLJ.exe
2272	fpyoBTb.exe
2260	lkuyNpd.exe
2924	fiyluKR.exe
596	pyEolAs.exe
2768	ildnhYD.exe
912	RuoTgNY.exe
3056	iHMtTLL.exe
1908	AnfaIzF.exe
2328	oqWRmsL.exe
932	VdAKztO.exe
976	HpMZtau.exe
2136	FcExKaJ.exe
1824	OCoHZAY.exe
1648	ohaNIFg.exe
2868	lThjGua.exe
896	uLfyrni.exe
608	FgKGXvo.exe
568	vicjkGI.exe
2116	NmxeSAC.exe
2100	vatEJzF.exe
1364	WRXlhqa.exe
1000	EJfjVvz.exe
2948	jMiBXPt.exe
2764	SXeLuxW.exe
2072	vnLlpiB.exe
2796	KwwGLsr.exe
1728	JpUEsVi.exe
2476	RGtCaQQ.exe
1716	czzkWpZ.exe
2896	jVMghys.exe
2620	UciPFqF.exe
2500	sLozglG.exe
2556	BxgTVds.exe
2560	zSyZSfs.exe
2408	zqUjaWC.exe
2444	WsXKkoD.exe
2648	CKlhxHb.exe
2876	JNhomdk.exe
2316	CVVMwPv.exe
2372	isMbeHz.exe

Loads dropped DLL 64 IoCs

pid	Process
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-1-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x000b0000000155e2-6.dat	upx
behavioral1/files/0x0024000000015c23-12.dat	upx
behavioral1/files/0x000f0000000006fd-19.dat	upx
behavioral1/files/0x0008000000015c69-23.dat	upx
behavioral1/files/0x0007000000015c7c-31.dat	upx
behavioral1/files/0x0014000000015c2f-40.dat	upx
behavioral1/files/0x0007000000015c87-36.dat	upx
behavioral1/files/0x000500000001868c-50.dat	upx
behavioral1/files/0x0005000000018698-63.dat	upx
behavioral1/files/0x0006000000018ae2-64.dat	upx
behavioral1/files/0x0006000000018ae8-71.dat	upx
behavioral1/files/0x0006000000018b15-78.dat	upx
behavioral1/memory/2836-120-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x0006000000018ba2-155.dat	upx
behavioral1/files/0x00050000000192c9-151.dat	upx
behavioral1/files/0x000500000001931b-166.dat	upx
behavioral1/files/0x0005000000019377-181.dat	upx
behavioral1/files/0x000500000001939b-186.dat	upx
behavioral1/files/0x0005000000019410-196.dat	upx
behavioral1/files/0x00050000000193b0-191.dat	upx
behavioral1/files/0x0005000000019368-176.dat	upx
behavioral1/files/0x0005000000019333-171.dat	upx
behavioral1/files/0x0006000000018b4a-141.dat	upx
behavioral1/files/0x0006000000018b37-132.dat	upx
behavioral1/memory/2124-128-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2376-127-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/files/0x0006000000018b73-126.dat	upx
behavioral1/files/0x00050000000192f4-159.dat	upx
behavioral1/memory/2676-105-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2504-92-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x0006000000018d06-147.dat	upx
behavioral1/memory/2396-110-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/memory/2196-108-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x0006000000018b96-135.dat	upx
behavioral1/memory/3032-124-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/392-122-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/files/0x0006000000018b6a-119.dat	upx
behavioral1/memory/2472-114-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2404-100-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/files/0x0006000000018b42-99.dat	upx
behavioral1/memory/2668-90-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x0006000000018b33-87.dat	upx
behavioral1/files/0x0009000000015d88-48.dat	upx
behavioral1/files/0x00050000000186a0-61.dat	upx
behavioral1/memory/2676-1759-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2504-1761-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2396-1782-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/memory/2196-1766-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2668-1765-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2404-1764-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2124-1763-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2836-2724-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/392-2723-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/3032-2789-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2376-2795-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2472-2783-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pyEolAs.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\ZsEpTwM.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\VRpOGFg.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\LTbdaeN.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\alkaxhD.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\ZMCCLnb.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\aRotiId.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\kBHaIQa.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\eJzJIQn.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\lfRemQp.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\XjjQvMb.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\wHYRwbq.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\SZtXLWb.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\EIgCQVn.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\yIPWNNs.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\dxtHjBX.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\KvjvtZc.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\oPveqtY.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\kjPpqXR.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\kRrYSPf.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\lMkOhir.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\QjBHRoM.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\csDYBcK.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\TlCUDam.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\CPEhbIh.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\ATnGEOL.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\SXeLuxW.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\WPhbhXp.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\cjjoDRC.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\slFjlBS.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\ISGlSik.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\KbwIuQb.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\xiOKave.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\nqqnkLO.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\sBcSiFf.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\PAtjAvc.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\gzhDqiI.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\rwFNczl.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\ntGtewN.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\VVjxAoX.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\QiXGGiH.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\MuJAVRu.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\VdAKztO.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\kobEpKK.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\HBCrKtL.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\JRABAwj.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\yINMqPg.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\kTsNcYz.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\EgCErwz.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\ixcYXAu.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\WiWgdOj.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\AwQoVej.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\TpxakOq.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\JzTktSq.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\yfZXPil.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\pLGZdgY.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\ZZIcXKd.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\ZEWzrJr.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\bpqJgSA.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\kFzsoVZ.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\SAZXYYN.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\bJVTiVn.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\FAeSNzS.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
File created	C:\Windows\System\pdTKAVL.exe	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2248	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
Token: SeDebugPrivilege	2248	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2248	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	29
PID 2936 wrote to memory of 2248	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	29
PID 2936 wrote to memory of 2248	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	29
PID 2936 wrote to memory of 2124	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2124	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2124	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2668	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2668	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2668	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2504	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	32
PID 2936 wrote to memory of 2504	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	32
PID 2936 wrote to memory of 2504	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	32
PID 2936 wrote to memory of 2404	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	33
PID 2936 wrote to memory of 2404	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	33
PID 2936 wrote to memory of 2404	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	33
PID 2936 wrote to memory of 2676	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	34
PID 2936 wrote to memory of 2676	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	34
PID 2936 wrote to memory of 2676	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	34
PID 2936 wrote to memory of 2196	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	35
PID 2936 wrote to memory of 2196	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	35
PID 2936 wrote to memory of 2196	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	35
PID 2936 wrote to memory of 2396	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	36
PID 2936 wrote to memory of 2396	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	36
PID 2936 wrote to memory of 2396	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	36
PID 2936 wrote to memory of 2472	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	37
PID 2936 wrote to memory of 2472	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	37
PID 2936 wrote to memory of 2472	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	37
PID 2936 wrote to memory of 2836	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	38
PID 2936 wrote to memory of 2836	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	38
PID 2936 wrote to memory of 2836	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	38
PID 2936 wrote to memory of 3032	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	39
PID 2936 wrote to memory of 3032	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	39
PID 2936 wrote to memory of 3032	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	39
PID 2936 wrote to memory of 392	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	40
PID 2936 wrote to memory of 392	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	40
PID 2936 wrote to memory of 392	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	40
PID 2936 wrote to memory of 2376	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	41
PID 2936 wrote to memory of 2376	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	41
PID 2936 wrote to memory of 2376	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	41
PID 2936 wrote to memory of 1660	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	42
PID 2936 wrote to memory of 1660	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	42
PID 2936 wrote to memory of 1660	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	42
PID 2936 wrote to memory of 840	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	43
PID 2936 wrote to memory of 840	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	43
PID 2936 wrote to memory of 840	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	43
PID 2936 wrote to memory of 1592	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	44
PID 2936 wrote to memory of 1592	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	44
PID 2936 wrote to memory of 1592	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	44
PID 2936 wrote to memory of 2688	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	45
PID 2936 wrote to memory of 2688	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	45
PID 2936 wrote to memory of 2688	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	45
PID 2936 wrote to memory of 2496	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	46
PID 2936 wrote to memory of 2496	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	46
PID 2936 wrote to memory of 2496	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	46
PID 2936 wrote to memory of 1092	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	47
PID 2936 wrote to memory of 1092	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	47
PID 2936 wrote to memory of 1092	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	47
PID 2936 wrote to memory of 2148	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	48
PID 2936 wrote to memory of 2148	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	48
PID 2936 wrote to memory of 2148	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	48
PID 2936 wrote to memory of 1296	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	49
PID 2936 wrote to memory of 1296	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	49
PID 2936 wrote to memory of 1296	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	49
PID 2936 wrote to memory of 1964	2936	34438f512883f426da25337a09dfa26d_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\34438f512883f426da25337a09dfa26d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\34438f512883f426da25337a09dfa26d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\System\TlmNTea.exe
  C:\Windows\System\TlmNTea.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\bqJcaXs.exe
  C:\Windows\System\bqJcaXs.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\CEndIBq.exe
  C:\Windows\System\CEndIBq.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\KvjvtZc.exe
  C:\Windows\System\KvjvtZc.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\NIxTXNF.exe
  C:\Windows\System\NIxTXNF.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\LqsjoZi.exe
  C:\Windows\System\LqsjoZi.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\jorHlub.exe
  C:\Windows\System\jorHlub.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\hPeBSUr.exe
  C:\Windows\System\hPeBSUr.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\oQaoUAZ.exe
  C:\Windows\System\oQaoUAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\Effwbvo.exe
  C:\Windows\System\Effwbvo.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\VatvTiI.exe
  C:\Windows\System\VatvTiI.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\JXaakuk.exe
  C:\Windows\System\JXaakuk.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\LOMxyur.exe
  C:\Windows\System\LOMxyur.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\LfgYIBs.exe
  C:\Windows\System\LfgYIBs.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\bEJpDQl.exe
  C:\Windows\System\bEJpDQl.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\guFpBNv.exe
  C:\Windows\System\guFpBNv.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\fseGfBe.exe
  C:\Windows\System\fseGfBe.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\oMclQrY.exe
  C:\Windows\System\oMclQrY.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\zdGFthS.exe
  C:\Windows\System\zdGFthS.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\BGKPIEB.exe
  C:\Windows\System\BGKPIEB.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\ClYoLmH.exe
  C:\Windows\System\ClYoLmH.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\fkvZFjt.exe
  C:\Windows\System\fkvZFjt.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\XMqtrph.exe
  C:\Windows\System\XMqtrph.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\fpyoBTb.exe
  C:\Windows\System\fpyoBTb.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\NWwNDLJ.exe
  C:\Windows\System\NWwNDLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\lkuyNpd.exe
  C:\Windows\System\lkuyNpd.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\fiyluKR.exe
  C:\Windows\System\fiyluKR.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\pyEolAs.exe
  C:\Windows\System\pyEolAs.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\ildnhYD.exe
  C:\Windows\System\ildnhYD.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\RuoTgNY.exe
  C:\Windows\System\RuoTgNY.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\iHMtTLL.exe
  C:\Windows\System\iHMtTLL.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\AnfaIzF.exe
  C:\Windows\System\AnfaIzF.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\oqWRmsL.exe
  C:\Windows\System\oqWRmsL.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\VdAKztO.exe
  C:\Windows\System\VdAKztO.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\HpMZtau.exe
  C:\Windows\System\HpMZtau.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\FcExKaJ.exe
  C:\Windows\System\FcExKaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\OCoHZAY.exe
  C:\Windows\System\OCoHZAY.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\ohaNIFg.exe
  C:\Windows\System\ohaNIFg.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\lThjGua.exe
  C:\Windows\System\lThjGua.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\uLfyrni.exe
  C:\Windows\System\uLfyrni.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\FgKGXvo.exe
  C:\Windows\System\FgKGXvo.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\vicjkGI.exe
  C:\Windows\System\vicjkGI.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\NmxeSAC.exe
  C:\Windows\System\NmxeSAC.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\vatEJzF.exe
  C:\Windows\System\vatEJzF.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\WRXlhqa.exe
  C:\Windows\System\WRXlhqa.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\EJfjVvz.exe
  C:\Windows\System\EJfjVvz.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\jMiBXPt.exe
  C:\Windows\System\jMiBXPt.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\SXeLuxW.exe
  C:\Windows\System\SXeLuxW.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\vnLlpiB.exe
  C:\Windows\System\vnLlpiB.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\KwwGLsr.exe
  C:\Windows\System\KwwGLsr.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\JpUEsVi.exe
  C:\Windows\System\JpUEsVi.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\RGtCaQQ.exe
  C:\Windows\System\RGtCaQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\czzkWpZ.exe
  C:\Windows\System\czzkWpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\jVMghys.exe
  C:\Windows\System\jVMghys.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\UciPFqF.exe
  C:\Windows\System\UciPFqF.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\sLozglG.exe
  C:\Windows\System\sLozglG.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\BxgTVds.exe
  C:\Windows\System\BxgTVds.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\zSyZSfs.exe
  C:\Windows\System\zSyZSfs.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\zqUjaWC.exe
  C:\Windows\System\zqUjaWC.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\WsXKkoD.exe
  C:\Windows\System\WsXKkoD.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\CKlhxHb.exe
  C:\Windows\System\CKlhxHb.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\JNhomdk.exe
  C:\Windows\System\JNhomdk.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\CVVMwPv.exe
  C:\Windows\System\CVVMwPv.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\isMbeHz.exe
  C:\Windows\System\isMbeHz.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\JZumeoP.exe
  C:\Windows\System\JZumeoP.exe
  2⤵
  PID:928
- C:\Windows\System\JtRyQCK.exe
  C:\Windows\System\JtRyQCK.exe
  2⤵
  PID:292
- C:\Windows\System\KfbROxC.exe
  C:\Windows\System\KfbROxC.exe
  2⤵
  PID:2228
- C:\Windows\System\gbNzUwV.exe
  C:\Windows\System\gbNzUwV.exe
  2⤵
  PID:2536
- C:\Windows\System\NVDLfte.exe
  C:\Windows\System\NVDLfte.exe
  2⤵
  PID:3048
- C:\Windows\System\QJtRyzc.exe
  C:\Windows\System\QJtRyzc.exe
  2⤵
  PID:572
- C:\Windows\System\ReuKETv.exe
  C:\Windows\System\ReuKETv.exe
  2⤵
  PID:1936
- C:\Windows\System\HiADTPQ.exe
  C:\Windows\System\HiADTPQ.exe
  2⤵
  PID:1180
- C:\Windows\System\UafeqZr.exe
  C:\Windows\System\UafeqZr.exe
  2⤵
  PID:2780
- C:\Windows\System\CIZVOQy.exe
  C:\Windows\System\CIZVOQy.exe
  2⤵
  PID:1196
- C:\Windows\System\DUlJdjI.exe
  C:\Windows\System\DUlJdjI.exe
  2⤵
  PID:2580
- C:\Windows\System\cxyRmdP.exe
  C:\Windows\System\cxyRmdP.exe
  2⤵
  PID:2940
- C:\Windows\System\YuySJJb.exe
  C:\Windows\System\YuySJJb.exe
  2⤵
  PID:2380
- C:\Windows\System\mWrjhkC.exe
  C:\Windows\System\mWrjhkC.exe
  2⤵
  PID:1848
- C:\Windows\System\gKEfHJk.exe
  C:\Windows\System\gKEfHJk.exe
  2⤵
  PID:1160
- C:\Windows\System\HOjPlBa.exe
  C:\Windows\System\HOjPlBa.exe
  2⤵
  PID:2988
- C:\Windows\System\xuqoIuH.exe
  C:\Windows\System\xuqoIuH.exe
  2⤵
  PID:1052
- C:\Windows\System\dJItwCY.exe
  C:\Windows\System\dJItwCY.exe
  2⤵
  PID:1624
- C:\Windows\System\YJfmOKR.exe
  C:\Windows\System\YJfmOKR.exe
  2⤵
  PID:2824
- C:\Windows\System\WqavcEI.exe
  C:\Windows\System\WqavcEI.exe
  2⤵
  PID:1820
- C:\Windows\System\kUcSTQh.exe
  C:\Windows\System\kUcSTQh.exe
  2⤵
  PID:972
- C:\Windows\System\lNNJSYu.exe
  C:\Windows\System\lNNJSYu.exe
  2⤵
  PID:1344
- C:\Windows\System\iyajWdp.exe
  C:\Windows\System\iyajWdp.exe
  2⤵
  PID:2028
- C:\Windows\System\ETcokZJ.exe
  C:\Windows\System\ETcokZJ.exe
  2⤵
  PID:1412
- C:\Windows\System\HozCBUk.exe
  C:\Windows\System\HozCBUk.exe
  2⤵
  PID:2860
- C:\Windows\System\LJkPKbS.exe
  C:\Windows\System\LJkPKbS.exe
  2⤵
  PID:880
- C:\Windows\System\yAuTPCo.exe
  C:\Windows\System\yAuTPCo.exe
  2⤵
  PID:1508
- C:\Windows\System\eAGevnK.exe
  C:\Windows\System\eAGevnK.exe
  2⤵
  PID:2052
- C:\Windows\System\ecuOJjl.exe
  C:\Windows\System\ecuOJjl.exe
  2⤵
  PID:1612
- C:\Windows\System\YUokpxa.exe
  C:\Windows\System\YUokpxa.exe
  2⤵
  PID:2612
- C:\Windows\System\AoXBHGd.exe
  C:\Windows\System\AoXBHGd.exe
  2⤵
  PID:2532
- C:\Windows\System\FOfxUVx.exe
  C:\Windows\System\FOfxUVx.exe
  2⤵
  PID:2848
- C:\Windows\System\FGtblON.exe
  C:\Windows\System\FGtblON.exe
  2⤵
  PID:2460
- C:\Windows\System\PvgGCpW.exe
  C:\Windows\System\PvgGCpW.exe
  2⤵
  PID:576
- C:\Windows\System\LQgssLT.exe
  C:\Windows\System\LQgssLT.exe
  2⤵
  PID:1304
- C:\Windows\System\SeBSdhn.exe
  C:\Windows\System\SeBSdhn.exe
  2⤵
  PID:556
- C:\Windows\System\IkYYkDs.exe
  C:\Windows\System\IkYYkDs.exe
  2⤵
  PID:2464
- C:\Windows\System\oWHYXbu.exe
  C:\Windows\System\oWHYXbu.exe
  2⤵
  PID:1912
- C:\Windows\System\gyRVIcM.exe
  C:\Windows\System\gyRVIcM.exe
  2⤵
  PID:2720
- C:\Windows\System\wmiXNKc.exe
  C:\Windows\System\wmiXNKc.exe
  2⤵
  PID:752
- C:\Windows\System\zndoXFO.exe
  C:\Windows\System\zndoXFO.exe
  2⤵
  PID:1744
- C:\Windows\System\nkwVqWa.exe
  C:\Windows\System\nkwVqWa.exe
  2⤵
  PID:1548
- C:\Windows\System\uzvRfPV.exe
  C:\Windows\System\uzvRfPV.exe
  2⤵
  PID:2240
- C:\Windows\System\wBaClMq.exe
  C:\Windows\System\wBaClMq.exe
  2⤵
  PID:2548
- C:\Windows\System\fwqIBuc.exe
  C:\Windows\System\fwqIBuc.exe
  2⤵
  PID:2340
- C:\Windows\System\rdzMAcQ.exe
  C:\Windows\System\rdzMAcQ.exe
  2⤵
  PID:2996
- C:\Windows\System\TUoVUzY.exe
  C:\Windows\System\TUoVUzY.exe
  2⤵
  PID:3068
- C:\Windows\System\bJONIUw.exe
  C:\Windows\System\bJONIUw.exe
  2⤵
  PID:1352
- C:\Windows\System\JxvNLfG.exe
  C:\Windows\System\JxvNLfG.exe
  2⤵
  PID:940
- C:\Windows\System\ASgIDAg.exe
  C:\Windows\System\ASgIDAg.exe
  2⤵
  PID:2264
- C:\Windows\System\mRBvPYL.exe
  C:\Windows\System\mRBvPYL.exe
  2⤵
  PID:1428
- C:\Windows\System\gNlPfkM.exe
  C:\Windows\System\gNlPfkM.exe
  2⤵
  PID:948
- C:\Windows\System\jfRupuf.exe
  C:\Windows\System\jfRupuf.exe
  2⤵
  PID:2864
- C:\Windows\System\ssVsbvl.exe
  C:\Windows\System\ssVsbvl.exe
  2⤵
  PID:1212
- C:\Windows\System\syoYiIz.exe
  C:\Windows\System\syoYiIz.exe
  2⤵
  PID:1540
- C:\Windows\System\yZeesnO.exe
  C:\Windows\System\yZeesnO.exe
  2⤵
  PID:1988
- C:\Windows\System\HHJTNPW.exe
  C:\Windows\System\HHJTNPW.exe
  2⤵
  PID:2156
- C:\Windows\System\jxPymwd.exe
  C:\Windows\System\jxPymwd.exe
  2⤵
  PID:2104
- C:\Windows\System\kCflpew.exe
  C:\Windows\System\kCflpew.exe
  2⤵
  PID:3004
- C:\Windows\System\IneQElZ.exe
  C:\Windows\System\IneQElZ.exe
  2⤵
  PID:2236
- C:\Windows\System\aprqPeK.exe
  C:\Windows\System\aprqPeK.exe
  2⤵
  PID:2280
- C:\Windows\System\KkHgthd.exe
  C:\Windows\System\KkHgthd.exe
  2⤵
  PID:2600
- C:\Windows\System\jgUqkDW.exe
  C:\Windows\System\jgUqkDW.exe
  2⤵
  PID:2596
- C:\Windows\System\ZwuCZRy.exe
  C:\Windows\System\ZwuCZRy.exe
  2⤵
  PID:3016
- C:\Windows\System\JDQdxOm.exe
  C:\Windows\System\JDQdxOm.exe
  2⤵
  PID:2964
- C:\Windows\System\nTGYcnq.exe
  C:\Windows\System\nTGYcnq.exe
  2⤵
  PID:2508
- C:\Windows\System\ayPvefY.exe
  C:\Windows\System\ayPvefY.exe
  2⤵
  PID:868
- C:\Windows\System\IfamsDg.exe
  C:\Windows\System\IfamsDg.exe
  2⤵
  PID:380
- C:\Windows\System\cdaoxLK.exe
  C:\Windows\System\cdaoxLK.exe
  2⤵
  PID:700
- C:\Windows\System\jcJVVgm.exe
  C:\Windows\System\jcJVVgm.exe
  2⤵
  PID:844
- C:\Windows\System\BWDcgPb.exe
  C:\Windows\System\BWDcgPb.exe
  2⤵
  PID:1060
- C:\Windows\System\tRIViuw.exe
  C:\Windows\System\tRIViuw.exe
  2⤵
  PID:2636
- C:\Windows\System\mCIPkhI.exe
  C:\Windows\System\mCIPkhI.exe
  2⤵
  PID:2628
- C:\Windows\System\boHnfsL.exe
  C:\Windows\System\boHnfsL.exe
  2⤵
  PID:2488
- C:\Windows\System\OPKchte.exe
  C:\Windows\System\OPKchte.exe
  2⤵
  PID:2204
- C:\Windows\System\ulsrFUe.exe
  C:\Windows\System\ulsrFUe.exe
  2⤵
  PID:2284
- C:\Windows\System\NtJLFdG.exe
  C:\Windows\System\NtJLFdG.exe
  2⤵
  PID:1572
- C:\Windows\System\muIsuiR.exe
  C:\Windows\System\muIsuiR.exe
  2⤵
  PID:2336
- C:\Windows\System\MyOZoNo.exe
  C:\Windows\System\MyOZoNo.exe
  2⤵
  PID:1940
- C:\Windows\System\qnhNmTg.exe
  C:\Windows\System\qnhNmTg.exe
  2⤵
  PID:1784
- C:\Windows\System\mDVFifx.exe
  C:\Windows\System\mDVFifx.exe
  2⤵
  PID:2776
- C:\Windows\System\TeIaRWu.exe
  C:\Windows\System\TeIaRWu.exe
  2⤵
  PID:1380
- C:\Windows\System\dlQAqeb.exe
  C:\Windows\System\dlQAqeb.exe
  2⤵
  PID:1588
- C:\Windows\System\pLGZdgY.exe
  C:\Windows\System\pLGZdgY.exe
  2⤵
  PID:1764
- C:\Windows\System\NeCgxsa.exe
  C:\Windows\System\NeCgxsa.exe
  2⤵
  PID:1644
- C:\Windows\System\QHDTYFA.exe
  C:\Windows\System\QHDTYFA.exe
  2⤵
  PID:3012
- C:\Windows\System\nVmDmxZ.exe
  C:\Windows\System\nVmDmxZ.exe
  2⤵
  PID:2484
- C:\Windows\System\BJihlon.exe
  C:\Windows\System\BJihlon.exe
  2⤵
  PID:1088
- C:\Windows\System\OLupDgQ.exe
  C:\Windows\System\OLupDgQ.exe
  2⤵
  PID:2808
- C:\Windows\System\pVfVhjj.exe
  C:\Windows\System\pVfVhjj.exe
  2⤵
  PID:436
- C:\Windows\System\MPgNuFV.exe
  C:\Windows\System\MPgNuFV.exe
  2⤵
  PID:2304
- C:\Windows\System\eMGnFKC.exe
  C:\Windows\System\eMGnFKC.exe
  2⤵
  PID:2552
- C:\Windows\System\mqBNrGi.exe
  C:\Windows\System\mqBNrGi.exe
  2⤵
  PID:2544
- C:\Windows\System\qwsAirt.exe
  C:\Windows\System\qwsAirt.exe
  2⤵
  PID:1096
- C:\Windows\System\UuyszdJ.exe
  C:\Windows\System\UuyszdJ.exe
  2⤵
  PID:1892
- C:\Windows\System\KYLERlD.exe
  C:\Windows\System\KYLERlD.exe
  2⤵
  PID:1712
- C:\Windows\System\geHPDMJ.exe
  C:\Windows\System\geHPDMJ.exe
  2⤵
  PID:2232
- C:\Windows\System\KZerbDM.exe
  C:\Windows\System\KZerbDM.exe
  2⤵
  PID:2660
- C:\Windows\System\PaxPRmz.exe
  C:\Windows\System\PaxPRmz.exe
  2⤵
  PID:2576
- C:\Windows\System\WGmOlIz.exe
  C:\Windows\System\WGmOlIz.exe
  2⤵
  PID:2696
- C:\Windows\System\pLaNtrI.exe
  C:\Windows\System\pLaNtrI.exe
  2⤵
  PID:800
- C:\Windows\System\egjqlAt.exe
  C:\Windows\System\egjqlAt.exe
  2⤵
  PID:1900
- C:\Windows\System\MKsGZWH.exe
  C:\Windows\System\MKsGZWH.exe
  2⤵
  PID:2300
- C:\Windows\System\jciohXy.exe
  C:\Windows\System\jciohXy.exe
  2⤵
  PID:1308
- C:\Windows\System\CkHkzzp.exe
  C:\Windows\System\CkHkzzp.exe
  2⤵
  PID:1684
- C:\Windows\System\jLZwFpr.exe
  C:\Windows\System\jLZwFpr.exe
  2⤵
  PID:876
- C:\Windows\System\frnEGIn.exe
  C:\Windows\System\frnEGIn.exe
  2⤵
  PID:2812
- C:\Windows\System\HSCDJtU.exe
  C:\Windows\System\HSCDJtU.exe
  2⤵
  PID:1976
- C:\Windows\System\lPWwGfl.exe
  C:\Windows\System\lPWwGfl.exe
  2⤵
  PID:3124
- C:\Windows\System\FCeoHUp.exe
  C:\Windows\System\FCeoHUp.exe
  2⤵
  PID:3144
- C:\Windows\System\WPhbhXp.exe
  C:\Windows\System\WPhbhXp.exe
  2⤵
  PID:3164
- C:\Windows\System\hLLPNRC.exe
  C:\Windows\System\hLLPNRC.exe
  2⤵
  PID:3180
- C:\Windows\System\sIWnlzV.exe
  C:\Windows\System\sIWnlzV.exe
  2⤵
  PID:3200
- C:\Windows\System\dqMbylg.exe
  C:\Windows\System\dqMbylg.exe
  2⤵
  PID:3224
- C:\Windows\System\ngYPQYL.exe
  C:\Windows\System\ngYPQYL.exe
  2⤵
  PID:3240
- C:\Windows\System\yJlqfEs.exe
  C:\Windows\System\yJlqfEs.exe
  2⤵
  PID:3256
- C:\Windows\System\yXlYmNL.exe
  C:\Windows\System\yXlYmNL.exe
  2⤵
  PID:3276
- C:\Windows\System\rdKUBvo.exe
  C:\Windows\System\rdKUBvo.exe
  2⤵
  PID:3292
- C:\Windows\System\yOJgIJj.exe
  C:\Windows\System\yOJgIJj.exe
  2⤵
  PID:3308
- C:\Windows\System\vPNZWLV.exe
  C:\Windows\System\vPNZWLV.exe
  2⤵
  PID:3324
- C:\Windows\System\oIBCyBg.exe
  C:\Windows\System\oIBCyBg.exe
  2⤵
  PID:3340
- C:\Windows\System\PTIgkvg.exe
  C:\Windows\System\PTIgkvg.exe
  2⤵
  PID:3388
- C:\Windows\System\YKvLzXJ.exe
  C:\Windows\System\YKvLzXJ.exe
  2⤵
  PID:3404
- C:\Windows\System\MnHDhRz.exe
  C:\Windows\System\MnHDhRz.exe
  2⤵
  PID:3420
- C:\Windows\System\STCMWrF.exe
  C:\Windows\System\STCMWrF.exe
  2⤵
  PID:3436
- C:\Windows\System\NhrPkCH.exe
  C:\Windows\System\NhrPkCH.exe
  2⤵
  PID:3452
- C:\Windows\System\SRqqQuS.exe
  C:\Windows\System\SRqqQuS.exe
  2⤵
  PID:3468
- C:\Windows\System\cMSehwd.exe
  C:\Windows\System\cMSehwd.exe
  2⤵
  PID:3484
- C:\Windows\System\LrSnQsi.exe
  C:\Windows\System\LrSnQsi.exe
  2⤵
  PID:3500
- C:\Windows\System\OdMLHyC.exe
  C:\Windows\System\OdMLHyC.exe
  2⤵
  PID:3520
- C:\Windows\System\CUNhNDy.exe
  C:\Windows\System\CUNhNDy.exe
  2⤵
  PID:3536
- C:\Windows\System\CyyDQeA.exe
  C:\Windows\System\CyyDQeA.exe
  2⤵
  PID:3552
- C:\Windows\System\bxfyQWB.exe
  C:\Windows\System\bxfyQWB.exe
  2⤵
  PID:3568
- C:\Windows\System\ROdUoae.exe
  C:\Windows\System\ROdUoae.exe
  2⤵
  PID:3588
- C:\Windows\System\OzAIYaB.exe
  C:\Windows\System\OzAIYaB.exe
  2⤵
  PID:3604
- C:\Windows\System\kTVJLIv.exe
  C:\Windows\System\kTVJLIv.exe
  2⤵
  PID:3676
- C:\Windows\System\ikPeaRJ.exe
  C:\Windows\System\ikPeaRJ.exe
  2⤵
  PID:3692
- C:\Windows\System\hgPCONc.exe
  C:\Windows\System\hgPCONc.exe
  2⤵
  PID:3708
- C:\Windows\System\RJxrrsg.exe
  C:\Windows\System\RJxrrsg.exe
  2⤵
  PID:3728
- C:\Windows\System\qDGvjWP.exe
  C:\Windows\System\qDGvjWP.exe
  2⤵
  PID:3744
- C:\Windows\System\uAVtIbA.exe
  C:\Windows\System\uAVtIbA.exe
  2⤵
  PID:3764
- C:\Windows\System\gNprLtV.exe
  C:\Windows\System\gNprLtV.exe
  2⤵
  PID:3780
- C:\Windows\System\urPEdZZ.exe
  C:\Windows\System\urPEdZZ.exe
  2⤵
  PID:3832
- C:\Windows\System\WPNLNiZ.exe
  C:\Windows\System\WPNLNiZ.exe
  2⤵
  PID:3884
- C:\Windows\System\ltgAcvI.exe
  C:\Windows\System\ltgAcvI.exe
  2⤵
  PID:3900
- C:\Windows\System\QjBHRoM.exe
  C:\Windows\System\QjBHRoM.exe
  2⤵
  PID:3928
- C:\Windows\System\mAnmEfJ.exe
  C:\Windows\System\mAnmEfJ.exe
  2⤵
  PID:3944
- C:\Windows\System\SalOxkt.exe
  C:\Windows\System\SalOxkt.exe
  2⤵
  PID:3960
- C:\Windows\System\nEMWRaS.exe
  C:\Windows\System\nEMWRaS.exe
  2⤵
  PID:3976
- C:\Windows\System\eqDvCtL.exe
  C:\Windows\System\eqDvCtL.exe
  2⤵
  PID:3996
- C:\Windows\System\alkaxhD.exe
  C:\Windows\System\alkaxhD.exe
  2⤵
  PID:4012
- C:\Windows\System\jySCflo.exe
  C:\Windows\System\jySCflo.exe
  2⤵
  PID:4028
- C:\Windows\System\QEbbFkq.exe
  C:\Windows\System\QEbbFkq.exe
  2⤵
  PID:4048
- C:\Windows\System\iBSDjAO.exe
  C:\Windows\System\iBSDjAO.exe
  2⤵
  PID:4068
- C:\Windows\System\DZyLmpC.exe
  C:\Windows\System\DZyLmpC.exe
  2⤵
  PID:4084
- C:\Windows\System\rxiikQD.exe
  C:\Windows\System\rxiikQD.exe
  2⤵
  PID:2540
- C:\Windows\System\jjIhfUu.exe
  C:\Windows\System\jjIhfUu.exe
  2⤵
  PID:2840
- C:\Windows\System\KSumvWO.exe
  C:\Windows\System\KSumvWO.exe
  2⤵
  PID:2952
- C:\Windows\System\vJfNPcN.exe
  C:\Windows\System\vJfNPcN.exe
  2⤵
  PID:1896
- C:\Windows\System\TCFEdPx.exe
  C:\Windows\System\TCFEdPx.exe
  2⤵
  PID:3080
- C:\Windows\System\eRAnPFN.exe
  C:\Windows\System\eRAnPFN.exe
  2⤵
  PID:672
- C:\Windows\System\oXZZbWd.exe
  C:\Windows\System\oXZZbWd.exe
  2⤵
  PID:3132
- C:\Windows\System\bUHoxyO.exe
  C:\Windows\System\bUHoxyO.exe
  2⤵
  PID:3084
- C:\Windows\System\nXqtAub.exe
  C:\Windows\System\nXqtAub.exe
  2⤵
  PID:2852
- C:\Windows\System\zEpDIxz.exe
  C:\Windows\System\zEpDIxz.exe
  2⤵
  PID:1444
- C:\Windows\System\bgqmIpi.exe
  C:\Windows\System\bgqmIpi.exe
  2⤵
  PID:3176
- C:\Windows\System\XYPKrHM.exe
  C:\Windows\System\XYPKrHM.exe
  2⤵
  PID:3152
- C:\Windows\System\hCEtUxW.exe
  C:\Windows\System\hCEtUxW.exe
  2⤵
  PID:3236
- C:\Windows\System\PSgfoFI.exe
  C:\Windows\System\PSgfoFI.exe
  2⤵
  PID:3332
- C:\Windows\System\XcnvvEf.exe
  C:\Windows\System\XcnvvEf.exe
  2⤵
  PID:3352
- C:\Windows\System\sbEHEad.exe
  C:\Windows\System\sbEHEad.exe
  2⤵
  PID:3220
- C:\Windows\System\QddTKJX.exe
  C:\Windows\System\QddTKJX.exe
  2⤵
  PID:3316
- C:\Windows\System\mKysGKt.exe
  C:\Windows\System\mKysGKt.exe
  2⤵
  PID:3364
- C:\Windows\System\IJdjqsM.exe
  C:\Windows\System\IJdjqsM.exe
  2⤵
  PID:3380
- C:\Windows\System\TjCMGXS.exe
  C:\Windows\System\TjCMGXS.exe
  2⤵
  PID:3444
- C:\Windows\System\CRxSXXH.exe
  C:\Windows\System\CRxSXXH.exe
  2⤵
  PID:3416
- C:\Windows\System\OhgcvUQ.exe
  C:\Windows\System\OhgcvUQ.exe
  2⤵
  PID:3512
- C:\Windows\System\PnKmrIH.exe
  C:\Windows\System\PnKmrIH.exe
  2⤵
  PID:3580
- C:\Windows\System\gzXojae.exe
  C:\Windows\System\gzXojae.exe
  2⤵
  PID:3620
- C:\Windows\System\WvHpQDG.exe
  C:\Windows\System\WvHpQDG.exe
  2⤵
  PID:3640
- C:\Windows\System\KDfvqJn.exe
  C:\Windows\System\KDfvqJn.exe
  2⤵
  PID:2344
- C:\Windows\System\ADeZvXz.exe
  C:\Windows\System\ADeZvXz.exe
  2⤵
  PID:3668
- C:\Windows\System\XfFOirH.exe
  C:\Windows\System\XfFOirH.exe
  2⤵
  PID:3736
- C:\Windows\System\EcKFipU.exe
  C:\Windows\System\EcKFipU.exe
  2⤵
  PID:3772
- C:\Windows\System\ztoIiTJ.exe
  C:\Windows\System\ztoIiTJ.exe
  2⤵
  PID:3464
- C:\Windows\System\bISyAXH.exe
  C:\Windows\System\bISyAXH.exe
  2⤵
  PID:3564
- C:\Windows\System\ViZibqZ.exe
  C:\Windows\System\ViZibqZ.exe
  2⤵
  PID:3684
- C:\Windows\System\DpNCVZL.exe
  C:\Windows\System\DpNCVZL.exe
  2⤵
  PID:3752
- C:\Windows\System\XUqmfJq.exe
  C:\Windows\System\XUqmfJq.exe
  2⤵
  PID:3844
- C:\Windows\System\KfLYXWi.exe
  C:\Windows\System\KfLYXWi.exe
  2⤵
  PID:3860
- C:\Windows\System\zfYpIEX.exe
  C:\Windows\System\zfYpIEX.exe
  2⤵
  PID:3872
- C:\Windows\System\bsyCwQC.exe
  C:\Windows\System\bsyCwQC.exe
  2⤵
  PID:3908
- C:\Windows\System\gkanHZv.exe
  C:\Windows\System\gkanHZv.exe
  2⤵
  PID:3936
- C:\Windows\System\Zmvbfid.exe
  C:\Windows\System\Zmvbfid.exe
  2⤵
  PID:3992
- C:\Windows\System\KCvYdof.exe
  C:\Windows\System\KCvYdof.exe
  2⤵
  PID:3104
- C:\Windows\System\zeRjXop.exe
  C:\Windows\System\zeRjXop.exe
  2⤵
  PID:4112
- C:\Windows\System\ThsgWGU.exe
  C:\Windows\System\ThsgWGU.exe
  2⤵
  PID:4132
- C:\Windows\System\cgwtrjH.exe
  C:\Windows\System\cgwtrjH.exe
  2⤵
  PID:4148
- C:\Windows\System\mGwHzeQ.exe
  C:\Windows\System\mGwHzeQ.exe
  2⤵
  PID:4164
- C:\Windows\System\qRHxbfZ.exe
  C:\Windows\System\qRHxbfZ.exe
  2⤵
  PID:4180
- C:\Windows\System\pfCZwgb.exe
  C:\Windows\System\pfCZwgb.exe
  2⤵
  PID:4196
- C:\Windows\System\HorCzLH.exe
  C:\Windows\System\HorCzLH.exe
  2⤵
  PID:4220
- C:\Windows\System\cSEfcJh.exe
  C:\Windows\System\cSEfcJh.exe
  2⤵
  PID:4240
- C:\Windows\System\kzjGakF.exe
  C:\Windows\System\kzjGakF.exe
  2⤵
  PID:4256
- C:\Windows\System\kSuAVjq.exe
  C:\Windows\System\kSuAVjq.exe
  2⤵
  PID:4280
- C:\Windows\System\RdBdYnO.exe
  C:\Windows\System\RdBdYnO.exe
  2⤵
  PID:4296
- C:\Windows\System\yaPHCgT.exe
  C:\Windows\System\yaPHCgT.exe
  2⤵
  PID:4312
- C:\Windows\System\dmBjPfm.exe
  C:\Windows\System\dmBjPfm.exe
  2⤵
  PID:4328
- C:\Windows\System\edtSucN.exe
  C:\Windows\System\edtSucN.exe
  2⤵
  PID:4348
- C:\Windows\System\CPEhbIh.exe
  C:\Windows\System\CPEhbIh.exe
  2⤵
  PID:4364
- C:\Windows\System\zHPRYtu.exe
  C:\Windows\System\zHPRYtu.exe
  2⤵
  PID:4384
- C:\Windows\System\NDraqzX.exe
  C:\Windows\System\NDraqzX.exe
  2⤵
  PID:4400
- C:\Windows\System\cpwewFV.exe
  C:\Windows\System\cpwewFV.exe
  2⤵
  PID:4416
- C:\Windows\System\egamnVA.exe
  C:\Windows\System\egamnVA.exe
  2⤵
  PID:4432
- C:\Windows\System\AUOwJYm.exe
  C:\Windows\System\AUOwJYm.exe
  2⤵
  PID:4452
- C:\Windows\System\wrjFQXU.exe
  C:\Windows\System\wrjFQXU.exe
  2⤵
  PID:4468
- C:\Windows\System\gbMAALo.exe
  C:\Windows\System\gbMAALo.exe
  2⤵
  PID:4488
- C:\Windows\System\UxnRyQQ.exe
  C:\Windows\System\UxnRyQQ.exe
  2⤵
  PID:4504
- C:\Windows\System\iKaaVCy.exe
  C:\Windows\System\iKaaVCy.exe
  2⤵
  PID:4520
- C:\Windows\System\jkEXiax.exe
  C:\Windows\System\jkEXiax.exe
  2⤵
  PID:4536
- C:\Windows\System\LxJGirp.exe
  C:\Windows\System\LxJGirp.exe
  2⤵
  PID:4552
- C:\Windows\System\wRsioos.exe
  C:\Windows\System\wRsioos.exe
  2⤵
  PID:4592
- C:\Windows\System\PyUFbim.exe
  C:\Windows\System\PyUFbim.exe
  2⤵
  PID:4608
- C:\Windows\System\wPwQfLX.exe
  C:\Windows\System\wPwQfLX.exe
  2⤵
  PID:4652
- C:\Windows\System\ZZMkGav.exe
  C:\Windows\System\ZZMkGav.exe
  2⤵
  PID:4668
- C:\Windows\System\fMALUXy.exe
  C:\Windows\System\fMALUXy.exe
  2⤵
  PID:4684
- C:\Windows\System\LWSZGgB.exe
  C:\Windows\System\LWSZGgB.exe
  2⤵
  PID:4720
- C:\Windows\System\mmkmocp.exe
  C:\Windows\System\mmkmocp.exe
  2⤵
  PID:4736
- C:\Windows\System\YaJRxtt.exe
  C:\Windows\System\YaJRxtt.exe
  2⤵
  PID:4752
- C:\Windows\System\xqtpPqz.exe
  C:\Windows\System\xqtpPqz.exe
  2⤵
  PID:4772
- C:\Windows\System\oYsEVRZ.exe
  C:\Windows\System\oYsEVRZ.exe
  2⤵
  PID:4792
- C:\Windows\System\MYGMcJq.exe
  C:\Windows\System\MYGMcJq.exe
  2⤵
  PID:4808
- C:\Windows\System\rrRwQCF.exe
  C:\Windows\System\rrRwQCF.exe
  2⤵
  PID:4828
- C:\Windows\System\PKLTjSq.exe
  C:\Windows\System\PKLTjSq.exe
  2⤵
  PID:4852
- C:\Windows\System\FDuALKO.exe
  C:\Windows\System\FDuALKO.exe
  2⤵
  PID:4872
- C:\Windows\System\fxkZyAg.exe
  C:\Windows\System\fxkZyAg.exe
  2⤵
  PID:4888
- C:\Windows\System\HsYJIio.exe
  C:\Windows\System\HsYJIio.exe
  2⤵
  PID:4928
- C:\Windows\System\WuSNlgs.exe
  C:\Windows\System\WuSNlgs.exe
  2⤵
  PID:4944
- C:\Windows\System\GoRkPmJ.exe
  C:\Windows\System\GoRkPmJ.exe
  2⤵
  PID:4960
- C:\Windows\System\fChygDm.exe
  C:\Windows\System\fChygDm.exe
  2⤵
  PID:4980
- C:\Windows\System\aQJLqvJ.exe
  C:\Windows\System\aQJLqvJ.exe
  2⤵
  PID:4996
- C:\Windows\System\RfWjmoB.exe
  C:\Windows\System\RfWjmoB.exe
  2⤵
  PID:5016
- C:\Windows\System\uqPBgVQ.exe
  C:\Windows\System\uqPBgVQ.exe
  2⤵
  PID:5036
- C:\Windows\System\UahFtGx.exe
  C:\Windows\System\UahFtGx.exe
  2⤵
  PID:5056
- C:\Windows\System\qnZfvHV.exe
  C:\Windows\System\qnZfvHV.exe
  2⤵
  PID:5072
- C:\Windows\System\PYlWxyQ.exe
  C:\Windows\System\PYlWxyQ.exe
  2⤵
  PID:5092
- C:\Windows\System\xGUDocl.exe
  C:\Windows\System\xGUDocl.exe
  2⤵
  PID:5108
- C:\Windows\System\WQrtcAV.exe
  C:\Windows\System\WQrtcAV.exe
  2⤵
  PID:3288
- C:\Windows\System\QFegmou.exe
  C:\Windows\System\QFegmou.exe
  2⤵
  PID:4024
- C:\Windows\System\DGutHFR.exe
  C:\Windows\System\DGutHFR.exe
  2⤵
  PID:3940
- C:\Windows\System\etLZJSo.exe
  C:\Windows\System\etLZJSo.exe
  2⤵
  PID:3232
- C:\Windows\System\bJVTiVn.exe
  C:\Windows\System\bJVTiVn.exe
  2⤵
  PID:3376
- C:\Windows\System\fpbRvVv.exe
  C:\Windows\System\fpbRvVv.exe
  2⤵
  PID:3892
- C:\Windows\System\dYjYCaK.exe
  C:\Windows\System\dYjYCaK.exe
  2⤵
  PID:4144
- C:\Windows\System\LTcvwqV.exe
  C:\Windows\System\LTcvwqV.exe
  2⤵
  PID:4216
- C:\Windows\System\zHQftLT.exe
  C:\Windows\System\zHQftLT.exe
  2⤵
  PID:4324
- C:\Windows\System\mbqaGWJ.exe
  C:\Windows\System\mbqaGWJ.exe
  2⤵
  PID:4428
- C:\Windows\System\Qrwbawf.exe
  C:\Windows\System\Qrwbawf.exe
  2⤵
  PID:4560
- C:\Windows\System\aATXorr.exe
  C:\Windows\System\aATXorr.exe
  2⤵
  PID:4044
- C:\Windows\System\CQzOfOj.exe
  C:\Windows\System\CQzOfOj.exe
  2⤵
  PID:3172
- C:\Windows\System\PkPXGVR.exe
  C:\Windows\System\PkPXGVR.exe
  2⤵
  PID:3480
- C:\Windows\System\WFZKKLZ.exe
  C:\Windows\System\WFZKKLZ.exe
  2⤵
  PID:4128
- C:\Windows\System\cSLszQo.exe
  C:\Windows\System\cSLszQo.exe
  2⤵
  PID:4336
- C:\Windows\System\FnOukMe.exe
  C:\Windows\System\FnOukMe.exe
  2⤵
  PID:4440
- C:\Windows\System\ZsElfzz.exe
  C:\Windows\System\ZsElfzz.exe
  2⤵
  PID:1272
- C:\Windows\System\dvVaeEa.exe
  C:\Windows\System\dvVaeEa.exe
  2⤵
  PID:1696
- C:\Windows\System\zcREeQe.exe
  C:\Windows\System\zcREeQe.exe
  2⤵
  PID:2312
- C:\Windows\System\kEXAYmc.exe
  C:\Windows\System\kEXAYmc.exe
  2⤵
  PID:3108
- C:\Windows\System\xIBbwgW.exe
  C:\Windows\System\xIBbwgW.exe
  2⤵
  PID:4412
- C:\Windows\System\PKYWmFV.exe
  C:\Windows\System\PKYWmFV.exe
  2⤵
  PID:4320
- C:\Windows\System\UyOsfXP.exe
  C:\Windows\System\UyOsfXP.exe
  2⤵
  PID:4392
- C:\Windows\System\kdffqal.exe
  C:\Windows\System\kdffqal.exe
  2⤵
  PID:3716
- C:\Windows\System\xWOzJrK.exe
  C:\Windows\System\xWOzJrK.exe
  2⤵
  PID:4604
- C:\Windows\System\wbcjftg.exe
  C:\Windows\System\wbcjftg.exe
  2⤵
  PID:4616
- C:\Windows\System\MZcQaaZ.exe
  C:\Windows\System\MZcQaaZ.exe
  2⤵
  PID:4600
- C:\Windows\System\exsQvdG.exe
  C:\Windows\System\exsQvdG.exe
  2⤵
  PID:3828
- C:\Windows\System\azNaodr.exe
  C:\Windows\System\azNaodr.exe
  2⤵
  PID:4624
- C:\Windows\System\FrpMuIN.exe
  C:\Windows\System\FrpMuIN.exe
  2⤵
  PID:4160
- C:\Windows\System\vEPQNyv.exe
  C:\Windows\System\vEPQNyv.exe
  2⤵
  PID:4632
- C:\Windows\System\mrqvETH.exe
  C:\Windows\System\mrqvETH.exe
  2⤵
  PID:4692
- C:\Windows\System\anHXaCs.exe
  C:\Windows\System\anHXaCs.exe
  2⤵
  PID:4664
- C:\Windows\System\zYJlcIS.exe
  C:\Windows\System\zYJlcIS.exe
  2⤵
  PID:4760
- C:\Windows\System\NPXivJB.exe
  C:\Windows\System\NPXivJB.exe
  2⤵
  PID:4700
- C:\Windows\System\IUaPFjF.exe
  C:\Windows\System\IUaPFjF.exe
  2⤵
  PID:4864
- C:\Windows\System\EaGLygE.exe
  C:\Windows\System\EaGLygE.exe
  2⤵
  PID:4588
- C:\Windows\System\YOwqeBC.exe
  C:\Windows\System\YOwqeBC.exe
  2⤵
  PID:4712
- C:\Windows\System\exgsjwJ.exe
  C:\Windows\System\exgsjwJ.exe
  2⤵
  PID:4844
- C:\Windows\System\Skslrgz.exe
  C:\Windows\System\Skslrgz.exe
  2⤵
  PID:4908
- C:\Windows\System\PDgJdnp.exe
  C:\Windows\System\PDgJdnp.exe
  2⤵
  PID:4816
- C:\Windows\System\qdlJQWB.exe
  C:\Windows\System\qdlJQWB.exe
  2⤵
  PID:4972
- C:\Windows\System\YAWSOYa.exe
  C:\Windows\System\YAWSOYa.exe
  2⤵
  PID:5004
- C:\Windows\System\sveqoCP.exe
  C:\Windows\System\sveqoCP.exe
  2⤵
  PID:5048
- C:\Windows\System\WDGcwyW.exe
  C:\Windows\System\WDGcwyW.exe
  2⤵
  PID:5088
- C:\Windows\System\GFOHaGW.exe
  C:\Windows\System\GFOHaGW.exe
  2⤵
  PID:4916
- C:\Windows\System\PtFtjlU.exe
  C:\Windows\System\PtFtjlU.exe
  2⤵
  PID:4956
- C:\Windows\System\yFxTLLJ.exe
  C:\Windows\System\yFxTLLJ.exe
  2⤵
  PID:5028
- C:\Windows\System\owgYJHr.exe
  C:\Windows\System\owgYJHr.exe
  2⤵
  PID:5100
- C:\Windows\System\nTzjpps.exe
  C:\Windows\System\nTzjpps.exe
  2⤵
  PID:3576
- C:\Windows\System\WKFFZPN.exe
  C:\Windows\System\WKFFZPN.exe
  2⤵
  PID:3528
- C:\Windows\System\gLJWrYR.exe
  C:\Windows\System\gLJWrYR.exe
  2⤵
  PID:3664
- C:\Windows\System\FGziEkG.exe
  C:\Windows\System\FGziEkG.exe
  2⤵
  PID:1920
- C:\Windows\System\GUKVRUJ.exe
  C:\Windows\System\GUKVRUJ.exe
  2⤵
  PID:3120
- C:\Windows\System\XUonsxF.exe
  C:\Windows\System\XUonsxF.exe
  2⤵
  PID:3272
- C:\Windows\System\lfRemQp.exe
  C:\Windows\System\lfRemQp.exe
  2⤵
  PID:3612
- C:\Windows\System\cAptAvz.exe
  C:\Windows\System\cAptAvz.exe
  2⤵
  PID:3372
- C:\Windows\System\bvmrvWT.exe
  C:\Windows\System\bvmrvWT.exe
  2⤵
  PID:4156
- C:\Windows\System\LENXPOO.exe
  C:\Windows\System\LENXPOO.exe
  2⤵
  PID:4484
- C:\Windows\System\IXJluFV.exe
  C:\Windows\System\IXJluFV.exe
  2⤵
  PID:3648
- C:\Windows\System\dOknXfn.exe
  C:\Windows\System\dOknXfn.exe
  2⤵
  PID:4040
- C:\Windows\System\AxLRzqi.exe
  C:\Windows\System\AxLRzqi.exe
  2⤵
  PID:1172
- C:\Windows\System\yjSSKok.exe
  C:\Windows\System\yjSSKok.exe
  2⤵
  PID:3988
- C:\Windows\System\kQerwBm.exe
  C:\Windows\System\kQerwBm.exe
  2⤵
  PID:4228
- C:\Windows\System\javiTZA.exe
  C:\Windows\System\javiTZA.exe
  2⤵
  PID:3600
- C:\Windows\System\DfWAQhK.exe
  C:\Windows\System\DfWAQhK.exe
  2⤵
  PID:3856
- C:\Windows\System\rovBBkb.exe
  C:\Windows\System\rovBBkb.exe
  2⤵
  PID:1724
- C:\Windows\System\uWsiHMF.exe
  C:\Windows\System\uWsiHMF.exe
  2⤵
  PID:1652
- C:\Windows\System\UqipFDr.exe
  C:\Windows\System\UqipFDr.exe
  2⤵
  PID:3100
- C:\Windows\System\WdtbiRY.exe
  C:\Windows\System\WdtbiRY.exe
  2⤵
  PID:3160
- C:\Windows\System\kdwDEMo.exe
  C:\Windows\System\kdwDEMo.exe
  2⤵
  PID:3356
- C:\Windows\System\WiWgdOj.exe
  C:\Windows\System\WiWgdOj.exe
  2⤵
  PID:4276
- C:\Windows\System\XshwmuA.exe
  C:\Windows\System\XshwmuA.exe
  2⤵
  PID:3912
- C:\Windows\System\yINMqPg.exe
  C:\Windows\System\yINMqPg.exe
  2⤵
  PID:3788
- C:\Windows\System\HxwjETq.exe
  C:\Windows\System\HxwjETq.exe
  2⤵
  PID:3924
- C:\Windows\System\evJrffu.exe
  C:\Windows\System\evJrffu.exe
  2⤵
  PID:4648
- C:\Windows\System\rHyKphe.exe
  C:\Windows\System\rHyKphe.exe
  2⤵
  PID:4768
- C:\Windows\System\dTOodfJ.exe
  C:\Windows\System\dTOodfJ.exe
  2⤵
  PID:4748
- C:\Windows\System\MpdNnzN.exe
  C:\Windows\System\MpdNnzN.exe
  2⤵
  PID:4896
- C:\Windows\System\YoKTYmf.exe
  C:\Windows\System\YoKTYmf.exe
  2⤵
  PID:3284
- C:\Windows\System\cTVwuWj.exe
  C:\Windows\System\cTVwuWj.exe
  2⤵
  PID:3548
- C:\Windows\System\YysvLCw.exe
  C:\Windows\System\YysvLCw.exe
  2⤵
  PID:4636
- C:\Windows\System\eBXZXYd.exe
  C:\Windows\System\eBXZXYd.exe
  2⤵
  PID:4800
- C:\Windows\System\KPmkXPA.exe
  C:\Windows\System\KPmkXPA.exe
  2⤵
  PID:1068
- C:\Windows\System\jWUnhnS.exe
  C:\Windows\System\jWUnhnS.exe
  2⤵
  PID:5084
- C:\Windows\System\EpiJnKU.exe
  C:\Windows\System\EpiJnKU.exe
  2⤵
  PID:5032
- C:\Windows\System\AwQoVej.exe
  C:\Windows\System\AwQoVej.exe
  2⤵
  PID:1756
- C:\Windows\System\IsibkGg.exe
  C:\Windows\System\IsibkGg.exe
  2⤵
  PID:1636
- C:\Windows\System\CJNCXfA.exe
  C:\Windows\System\CJNCXfA.exe
  2⤵
  PID:3300
- C:\Windows\System\CvYaqsr.exe
  C:\Windows\System\CvYaqsr.exe
  2⤵
  PID:4372
- C:\Windows\System\erqEuDE.exe
  C:\Windows\System\erqEuDE.exe
  2⤵
  PID:3264
- C:\Windows\System\JRABAwj.exe
  C:\Windows\System\JRABAwj.exe
  2⤵
  PID:2308
- C:\Windows\System\sfzercB.exe
  C:\Windows\System\sfzercB.exe
  2⤵
  PID:3112
- C:\Windows\System\pHftAXE.exe
  C:\Windows\System\pHftAXE.exe
  2⤵
  PID:3968
- C:\Windows\System\hpKXBNM.exe
  C:\Windows\System\hpKXBNM.exe
  2⤵
  PID:3304
- C:\Windows\System\szBThVJ.exe
  C:\Windows\System\szBThVJ.exe
  2⤵
  PID:4172
- C:\Windows\System\DFeNRMJ.exe
  C:\Windows\System\DFeNRMJ.exe
  2⤵
  PID:4448
- C:\Windows\System\tbBpbaG.exe
  C:\Windows\System\tbBpbaG.exe
  2⤵
  PID:4516
- C:\Windows\System\lUhvqOH.exe
  C:\Windows\System\lUhvqOH.exe
  2⤵
  PID:4940
- C:\Windows\System\ILPqIIt.exe
  C:\Windows\System\ILPqIIt.exe
  2⤵
  PID:5024
- C:\Windows\System\oudddCh.exe
  C:\Windows\System\oudddCh.exe
  2⤵
  PID:4884
- C:\Windows\System\LdIgHiq.exe
  C:\Windows\System\LdIgHiq.exe
  2⤵
  PID:1672
- C:\Windows\System\GqLSzSl.exe
  C:\Windows\System\GqLSzSl.exe
  2⤵
  PID:4784
- C:\Windows\System\LJOXiay.exe
  C:\Windows\System\LJOXiay.exe
  2⤵
  PID:3652
- C:\Windows\System\iGeYkDh.exe
  C:\Windows\System\iGeYkDh.exe
  2⤵
  PID:4528
- C:\Windows\System\JlLMVmE.exe
  C:\Windows\System\JlLMVmE.exe
  2⤵
  PID:4292
- C:\Windows\System\QVQRnlX.exe
  C:\Windows\System\QVQRnlX.exe
  2⤵
  PID:4188
- C:\Windows\System\AlvYAbP.exe
  C:\Windows\System\AlvYAbP.exe
  2⤵
  PID:792
- C:\Windows\System\gUQEpxu.exe
  C:\Windows\System\gUQEpxu.exe
  2⤵
  PID:4824
- C:\Windows\System\JmGHyKa.exe
  C:\Windows\System\JmGHyKa.exe
  2⤵
  PID:4976
- C:\Windows\System\sosUhRz.exe
  C:\Windows\System\sosUhRz.exe
  2⤵
  PID:4952
- C:\Windows\System\FGSSQWb.exe
  C:\Windows\System\FGSSQWb.exe
  2⤵
  PID:1692
- C:\Windows\System\wDTHdnu.exe
  C:\Windows\System\wDTHdnu.exe
  2⤵
  PID:2000
- C:\Windows\System\rUocaqK.exe
  C:\Windows\System\rUocaqK.exe
  2⤵
  PID:3348
- C:\Windows\System\TwRedTQ.exe
  C:\Windows\System\TwRedTQ.exe
  2⤵
  PID:4008
- C:\Windows\System\vnqSAPE.exe
  C:\Windows\System\vnqSAPE.exe
  2⤵
  PID:4992
- C:\Windows\System\XjjQvMb.exe
  C:\Windows\System\XjjQvMb.exe
  2⤵
  PID:4480
- C:\Windows\System\jQKHMLT.exe
  C:\Windows\System\jQKHMLT.exe
  2⤵
  PID:3432
- C:\Windows\System\mFSMJbu.exe
  C:\Windows\System\mFSMJbu.exe
  2⤵
  PID:4060
- C:\Windows\System\eQLTbHs.exe
  C:\Windows\System\eQLTbHs.exe
  2⤵
  PID:5168
- C:\Windows\System\JdsKKem.exe
  C:\Windows\System\JdsKKem.exe
  2⤵
  PID:5184
- C:\Windows\System\pSzZaev.exe
  C:\Windows\System\pSzZaev.exe
  2⤵
  PID:5268
- C:\Windows\System\NCcNUZC.exe
  C:\Windows\System\NCcNUZC.exe
  2⤵
  PID:5284
- C:\Windows\System\XuVPvDy.exe
  C:\Windows\System\XuVPvDy.exe
  2⤵
  PID:5308
- C:\Windows\System\ZMZUBoU.exe
  C:\Windows\System\ZMZUBoU.exe
  2⤵
  PID:5400
- C:\Windows\System\zZIrVMF.exe
  C:\Windows\System\zZIrVMF.exe
  2⤵
  PID:5448
- C:\Windows\System\YNgZIsQ.exe
  C:\Windows\System\YNgZIsQ.exe
  2⤵
  PID:5464
- C:\Windows\System\aUegyIW.exe
  C:\Windows\System\aUegyIW.exe
  2⤵
  PID:5480
- C:\Windows\System\YhoAgdD.exe
  C:\Windows\System\YhoAgdD.exe
  2⤵
  PID:5496
- C:\Windows\System\HLYxDWG.exe
  C:\Windows\System\HLYxDWG.exe
  2⤵
  PID:5512
- C:\Windows\System\tbTOoMN.exe
  C:\Windows\System\tbTOoMN.exe
  2⤵
  PID:5528
- C:\Windows\System\XhScMPc.exe
  C:\Windows\System\XhScMPc.exe
  2⤵
  PID:5544
- C:\Windows\System\RyVlESq.exe
  C:\Windows\System\RyVlESq.exe
  2⤵
  PID:5560
- C:\Windows\System\hRSwxge.exe
  C:\Windows\System\hRSwxge.exe
  2⤵
  PID:5576
- C:\Windows\System\coOdYRk.exe
  C:\Windows\System\coOdYRk.exe
  2⤵
  PID:5592
- C:\Windows\System\GlCSSQm.exe
  C:\Windows\System\GlCSSQm.exe
  2⤵
  PID:5612
- C:\Windows\System\NWbsBmw.exe
  C:\Windows\System\NWbsBmw.exe
  2⤵
  PID:5628
- C:\Windows\System\KQQStsR.exe
  C:\Windows\System\KQQStsR.exe
  2⤵
  PID:5644
- C:\Windows\System\TyWnDJZ.exe
  C:\Windows\System\TyWnDJZ.exe
  2⤵
  PID:5660
- C:\Windows\System\dkxHfUi.exe
  C:\Windows\System\dkxHfUi.exe
  2⤵
  PID:5676
- C:\Windows\System\TavCxSC.exe
  C:\Windows\System\TavCxSC.exe
  2⤵
  PID:5692
- C:\Windows\System\HnOSsnJ.exe
  C:\Windows\System\HnOSsnJ.exe
  2⤵
  PID:5708
- C:\Windows\System\vEOjjxX.exe
  C:\Windows\System\vEOjjxX.exe
  2⤵
  PID:5724
- C:\Windows\System\PJTtiKq.exe
  C:\Windows\System\PJTtiKq.exe
  2⤵
  PID:5740
- C:\Windows\System\BPNioAF.exe
  C:\Windows\System\BPNioAF.exe
  2⤵
  PID:5756
- C:\Windows\System\GYEsadh.exe
  C:\Windows\System\GYEsadh.exe
  2⤵
  PID:5776
- C:\Windows\System\ttuDWqH.exe
  C:\Windows\System\ttuDWqH.exe
  2⤵
  PID:5796
- C:\Windows\System\THQjebt.exe
  C:\Windows\System\THQjebt.exe
  2⤵
  PID:5832
- C:\Windows\System\sPVbRwZ.exe
  C:\Windows\System\sPVbRwZ.exe
  2⤵
  PID:5848
- C:\Windows\System\vWrvNTZ.exe
  C:\Windows\System\vWrvNTZ.exe
  2⤵
  PID:5924
- C:\Windows\System\aMRyWAR.exe
  C:\Windows\System\aMRyWAR.exe
  2⤵
  PID:5944
- C:\Windows\System\cbiNYMR.exe
  C:\Windows\System\cbiNYMR.exe
  2⤵
  PID:6036
- C:\Windows\System\JRIQmis.exe
  C:\Windows\System\JRIQmis.exe
  2⤵
  PID:6052
- C:\Windows\System\UKuaOEe.exe
  C:\Windows\System\UKuaOEe.exe
  2⤵
  PID:6068
- C:\Windows\System\jdpBETe.exe
  C:\Windows\System\jdpBETe.exe
  2⤵
  PID:6084
- C:\Windows\System\qmUwdmk.exe
  C:\Windows\System\qmUwdmk.exe
  2⤵
  PID:6100
- C:\Windows\System\qcaEIkh.exe
  C:\Windows\System\qcaEIkh.exe
  2⤵
  PID:6116
- C:\Windows\System\TuTAyWH.exe
  C:\Windows\System\TuTAyWH.exe
  2⤵
  PID:6136
- C:\Windows\System\MMisFzL.exe
  C:\Windows\System\MMisFzL.exe
  2⤵
  PID:4212
- C:\Windows\System\mHSLoMf.exe
  C:\Windows\System\mHSLoMf.exe
  2⤵
  PID:1884
- C:\Windows\System\FkkOofT.exe
  C:\Windows\System\FkkOofT.exe
  2⤵
  PID:5148
- C:\Windows\System\bptBlCy.exe
  C:\Windows\System\bptBlCy.exe
  2⤵
  PID:240
- C:\Windows\System\QtwAXAg.exe
  C:\Windows\System\QtwAXAg.exe
  2⤵
  PID:5152
- C:\Windows\System\WyDUXRq.exe
  C:\Windows\System\WyDUXRq.exe
  2⤵
  PID:4544
- C:\Windows\System\tyNIGuS.exe
  C:\Windows\System\tyNIGuS.exe
  2⤵
  PID:5160
- C:\Windows\System\LlbxBHL.exe
  C:\Windows\System\LlbxBHL.exe
  2⤵
  PID:5212
- C:\Windows\System\BENmMni.exe
  C:\Windows\System\BENmMni.exe
  2⤵
  PID:5236
- C:\Windows\System\lFQRyTl.exe
  C:\Windows\System\lFQRyTl.exe
  2⤵
  PID:5276
- C:\Windows\System\wHYRwbq.exe
  C:\Windows\System\wHYRwbq.exe
  2⤵
  PID:5292
- C:\Windows\System\QFjMJci.exe
  C:\Windows\System\QFjMJci.exe
  2⤵
  PID:5320
- C:\Windows\System\RBOAfsf.exe
  C:\Windows\System\RBOAfsf.exe
  2⤵
  PID:5296
- C:\Windows\System\SBjVUck.exe
  C:\Windows\System\SBjVUck.exe
  2⤵
  PID:5348
- C:\Windows\System\CswsoRd.exe
  C:\Windows\System\CswsoRd.exe
  2⤵
  PID:5380
- C:\Windows\System\qZipZqq.exe
  C:\Windows\System\qZipZqq.exe
  2⤵
  PID:5416
- C:\Windows\System\IVnuLhU.exe
  C:\Windows\System\IVnuLhU.exe
  2⤵
  PID:5444
- C:\Windows\System\cPYaXbg.exe
  C:\Windows\System\cPYaXbg.exe
  2⤵
  PID:5492
- C:\Windows\System\yQFQmzb.exe
  C:\Windows\System\yQFQmzb.exe
  2⤵
  PID:5552
- C:\Windows\System\AQTaYIG.exe
  C:\Windows\System\AQTaYIG.exe
  2⤵
  PID:5620
- C:\Windows\System\gvvQzru.exe
  C:\Windows\System\gvvQzru.exe
  2⤵
  PID:5656
- C:\Windows\System\EAmsZRI.exe
  C:\Windows\System\EAmsZRI.exe
  2⤵
  PID:5720
- C:\Windows\System\AIZjPlb.exe
  C:\Windows\System\AIZjPlb.exe
  2⤵
  PID:5752
- C:\Windows\System\bWRNsae.exe
  C:\Windows\System\bWRNsae.exe
  2⤵
  PID:5672
- C:\Windows\System\LbTbfxY.exe
  C:\Windows\System\LbTbfxY.exe
  2⤵
  PID:5600
- C:\Windows\System\YgtkagZ.exe
  C:\Windows\System\YgtkagZ.exe
  2⤵
  PID:5700
- C:\Windows\System\DhuBdlO.exe
  C:\Windows\System\DhuBdlO.exe
  2⤵
  PID:5412
- C:\Windows\System\DRqzUXL.exe
  C:\Windows\System\DRqzUXL.exe
  2⤵
  PID:5804
- C:\Windows\System\WcPkjhO.exe
  C:\Windows\System\WcPkjhO.exe
  2⤵
  PID:5820
- C:\Windows\System\TuAUkQU.exe
  C:\Windows\System\TuAUkQU.exe
  2⤵
  PID:5868
- C:\Windows\System\JDqZtTk.exe
  C:\Windows\System\JDqZtTk.exe
  2⤵
  PID:5880
- C:\Windows\System\ByFDbPp.exe
  C:\Windows\System\ByFDbPp.exe
  2⤵
  PID:5940
- C:\Windows\System\JNwROEp.exe
  C:\Windows\System\JNwROEp.exe
  2⤵
  PID:5960
- C:\Windows\System\YkDnLYl.exe
  C:\Windows\System\YkDnLYl.exe
  2⤵
  PID:5976
- C:\Windows\System\QxPfRRI.exe
  C:\Windows\System\QxPfRRI.exe
  2⤵
  PID:6092
- C:\Windows\System\EEfuLoS.exe
  C:\Windows\System\EEfuLoS.exe
  2⤵
  PID:4900
- C:\Windows\System\OBBTENR.exe
  C:\Windows\System\OBBTENR.exe
  2⤵
  PID:5988
- C:\Windows\System\eyAdxiM.exe
  C:\Windows\System\eyAdxiM.exe
  2⤵
  PID:6012
- C:\Windows\System\ZGiiiPA.exe
  C:\Windows\System\ZGiiiPA.exe
  2⤵
  PID:6032
- C:\Windows\System\DqvYlXC.exe
  C:\Windows\System\DqvYlXC.exe
  2⤵
  PID:5240
- C:\Windows\System\CZMDpqx.exe
  C:\Windows\System\CZMDpqx.exe
  2⤵
  PID:6112
- C:\Windows\System\GnXpJnM.exe
  C:\Windows\System\GnXpJnM.exe
  2⤵
  PID:5192
- C:\Windows\System\mmsPJaK.exe
  C:\Windows\System\mmsPJaK.exe
  2⤵
  PID:5164
- C:\Windows\System\NIskuzE.exe
  C:\Windows\System\NIskuzE.exe
  2⤵
  PID:5304
- C:\Windows\System\AOxRANu.exe
  C:\Windows\System\AOxRANu.exe
  2⤵
  PID:5888
- C:\Windows\System\SLVFANw.exe
  C:\Windows\System\SLVFANw.exe
  2⤵
  PID:5792
- C:\Windows\System\Hctbjuc.exe
  C:\Windows\System\Hctbjuc.exe
  2⤵
  PID:5520
- C:\Windows\System\TpxakOq.exe
  C:\Windows\System\TpxakOq.exe
  2⤵
  PID:5540
- C:\Windows\System\bKrRsPG.exe
  C:\Windows\System\bKrRsPG.exe
  2⤵
  PID:5652
- C:\Windows\System\adRbGMZ.exe
  C:\Windows\System\adRbGMZ.exe
  2⤵
  PID:2008
- C:\Windows\System\wARHrSc.exe
  C:\Windows\System\wARHrSc.exe
  2⤵
  PID:5568
- C:\Windows\System\AulicWV.exe
  C:\Windows\System\AulicWV.exe
  2⤵
  PID:5876
- C:\Windows\System\JdCufON.exe
  C:\Windows\System\JdCufON.exe
  2⤵
  PID:5992
- C:\Windows\System\ptSttQL.exe
  C:\Windows\System\ptSttQL.exe
  2⤵
  PID:5132
- C:\Windows\System\KUTwWyj.exe
  C:\Windows\System\KUTwWyj.exe
  2⤵
  PID:5136
- C:\Windows\System\wkzwWnD.exe
  C:\Windows\System\wkzwWnD.exe
  2⤵
  PID:5252
- C:\Windows\System\aNurDaX.exe
  C:\Windows\System\aNurDaX.exe
  2⤵
  PID:5408
- C:\Windows\System\bFjuqMu.exe
  C:\Windows\System\bFjuqMu.exe
  2⤵
  PID:5436
- C:\Windows\System\nMOlwcN.exe
  C:\Windows\System\nMOlwcN.exe
  2⤵
  PID:6108
- C:\Windows\System\GhhDgab.exe
  C:\Windows\System\GhhDgab.exe
  2⤵
  PID:5328
- C:\Windows\System\FGWKtcc.exe
  C:\Windows\System\FGWKtcc.exe
  2⤵
  PID:5972
- C:\Windows\System\SVuWLLr.exe
  C:\Windows\System\SVuWLLr.exe
  2⤵
  PID:5300
- C:\Windows\System\oUeNLVp.exe
  C:\Windows\System\oUeNLVp.exe
  2⤵
  PID:6060
- C:\Windows\System\YeXFIwI.exe
  C:\Windows\System\YeXFIwI.exe
  2⤵
  PID:5952
- C:\Windows\System\WxAYyEG.exe
  C:\Windows\System\WxAYyEG.exe
  2⤵
  PID:5208
- C:\Windows\System\AKDUGBL.exe
  C:\Windows\System\AKDUGBL.exe
  2⤵
  PID:5248
- C:\Windows\System\lGJhToO.exe
  C:\Windows\System\lGJhToO.exe
  2⤵
  PID:5588
- C:\Windows\System\SvOmJsV.exe
  C:\Windows\System\SvOmJsV.exe
  2⤵
  PID:5716
- C:\Windows\System\bBVRLRY.exe
  C:\Windows\System\bBVRLRY.exe
  2⤵
  PID:4660
- C:\Windows\System\ioCEiFl.exe
  C:\Windows\System\ioCEiFl.exe
  2⤵
  PID:6080
- C:\Windows\System\WmejBMh.exe
  C:\Windows\System\WmejBMh.exe
  2⤵
  PID:5332
- C:\Windows\System\ijhEiQF.exe
  C:\Windows\System\ijhEiQF.exe
  2⤵
  PID:5904
- C:\Windows\System\GYeccAg.exe
  C:\Windows\System\GYeccAg.exe
  2⤵
  PID:5128
- C:\Windows\System\rBwIsdW.exe
  C:\Windows\System\rBwIsdW.exe
  2⤵
  PID:5316
- C:\Windows\System\gOluIOM.exe
  C:\Windows\System\gOluIOM.exe
  2⤵
  PID:5920
- C:\Windows\System\ftXljwb.exe
  C:\Windows\System\ftXljwb.exe
  2⤵
  PID:5156
- C:\Windows\System\hearxEO.exe
  C:\Windows\System\hearxEO.exe
  2⤵
  PID:5908
- C:\Windows\System\iSvpZQm.exe
  C:\Windows\System\iSvpZQm.exe
  2⤵
  PID:6164
- C:\Windows\System\AAYByvb.exe
  C:\Windows\System\AAYByvb.exe
  2⤵
  PID:6180
- C:\Windows\System\FNdvQVU.exe
  C:\Windows\System\FNdvQVU.exe
  2⤵
  PID:6200
- C:\Windows\System\VrVDRhO.exe
  C:\Windows\System\VrVDRhO.exe
  2⤵
  PID:6220
- C:\Windows\System\TjvzUZJ.exe
  C:\Windows\System\TjvzUZJ.exe
  2⤵
  PID:6236
- C:\Windows\System\SjCAfHw.exe
  C:\Windows\System\SjCAfHw.exe
  2⤵
  PID:6256
- C:\Windows\System\csDYBcK.exe
  C:\Windows\System\csDYBcK.exe
  2⤵
  PID:6272
- C:\Windows\System\SZtXLWb.exe
  C:\Windows\System\SZtXLWb.exe
  2⤵
  PID:6288
- C:\Windows\System\cjMJKrV.exe
  C:\Windows\System\cjMJKrV.exe
  2⤵
  PID:6304
- C:\Windows\System\qRnaqcP.exe
  C:\Windows\System\qRnaqcP.exe
  2⤵
  PID:6336
- C:\Windows\System\BhXVEIX.exe
  C:\Windows\System\BhXVEIX.exe
  2⤵
  PID:6356
- C:\Windows\System\bHfqMLL.exe
  C:\Windows\System\bHfqMLL.exe
  2⤵
  PID:6476
- C:\Windows\System\eAJiLOF.exe
  C:\Windows\System\eAJiLOF.exe
  2⤵
  PID:6500
- C:\Windows\System\kaITgHP.exe
  C:\Windows\System\kaITgHP.exe
  2⤵
  PID:6516
- C:\Windows\System\lkpVXai.exe
  C:\Windows\System\lkpVXai.exe
  2⤵
  PID:6536
- C:\Windows\System\IRMspPQ.exe
  C:\Windows\System\IRMspPQ.exe
  2⤵
  PID:6552
- C:\Windows\System\uUGPhuH.exe
  C:\Windows\System\uUGPhuH.exe
  2⤵
  PID:6568
- C:\Windows\System\SUpAPDz.exe
  C:\Windows\System\SUpAPDz.exe
  2⤵
  PID:6584
- C:\Windows\System\sBcSiFf.exe
  C:\Windows\System\sBcSiFf.exe
  2⤵
  PID:6600
- C:\Windows\System\kTsNcYz.exe
  C:\Windows\System\kTsNcYz.exe
  2⤵
  PID:6616
- C:\Windows\System\uHlSJCD.exe
  C:\Windows\System\uHlSJCD.exe
  2⤵
  PID:6636
- C:\Windows\System\dfCqWJK.exe
  C:\Windows\System\dfCqWJK.exe
  2⤵
  PID:6740
- C:\Windows\System\UPDLGFA.exe
  C:\Windows\System\UPDLGFA.exe
  2⤵
  PID:6776
- C:\Windows\System\kzYRPsx.exe
  C:\Windows\System\kzYRPsx.exe
  2⤵
  PID:6928
- C:\Windows\System\HUlNawR.exe
  C:\Windows\System\HUlNawR.exe
  2⤵
  PID:6944
- C:\Windows\System\OufzORi.exe
  C:\Windows\System\OufzORi.exe
  2⤵
  PID:6960
- C:\Windows\System\fMyHVlW.exe
  C:\Windows\System\fMyHVlW.exe
  2⤵
  PID:6976
- C:\Windows\System\SIVbhTQ.exe
  C:\Windows\System\SIVbhTQ.exe
  2⤵
  PID:6992
- C:\Windows\System\ZVZoPAx.exe
  C:\Windows\System\ZVZoPAx.exe
  2⤵
  PID:7008
- C:\Windows\System\pHlNUVA.exe
  C:\Windows\System\pHlNUVA.exe
  2⤵
  PID:7024
- C:\Windows\System\YQlzhHb.exe
  C:\Windows\System\YQlzhHb.exe
  2⤵
  PID:7040
- C:\Windows\System\NrpyLCf.exe
  C:\Windows\System\NrpyLCf.exe
  2⤵
  PID:7056
- C:\Windows\System\xjYqolm.exe
  C:\Windows\System\xjYqolm.exe
  2⤵
  PID:7072
- C:\Windows\System\DCccUiO.exe
  C:\Windows\System\DCccUiO.exe
  2⤵
  PID:7088
- C:\Windows\System\CYMYvRB.exe
  C:\Windows\System\CYMYvRB.exe
  2⤵
  PID:7124
- C:\Windows\System\FJylkMD.exe
  C:\Windows\System\FJylkMD.exe
  2⤵
  PID:7140
- C:\Windows\System\tZxCULf.exe
  C:\Windows\System\tZxCULf.exe
  2⤵
  PID:7156
- C:\Windows\System\hgriePs.exe
  C:\Windows\System\hgriePs.exe
  2⤵
  PID:6148
- C:\Windows\System\vgvhbxc.exe
  C:\Windows\System\vgvhbxc.exe
  2⤵
  PID:5912
- C:\Windows\System\glHlarS.exe
  C:\Windows\System\glHlarS.exe
  2⤵
  PID:5224
- C:\Windows\System\aFORIUH.exe
  C:\Windows\System\aFORIUH.exe
  2⤵
  PID:1564
- C:\Windows\System\cYaWmSc.exe
  C:\Windows\System\cYaWmSc.exe
  2⤵
  PID:6152
- C:\Windows\System\PEffEUO.exe
  C:\Windows\System\PEffEUO.exe
  2⤵
  PID:6316
- C:\Windows\System\RMprpwX.exe
  C:\Windows\System\RMprpwX.exe
  2⤵
  PID:6344
- C:\Windows\System\fnCtGxK.exe
  C:\Windows\System\fnCtGxK.exe
  2⤵
  PID:6496
- C:\Windows\System\WjDwfuD.exe
  C:\Windows\System\WjDwfuD.exe
  2⤵
  PID:6532
- C:\Windows\System\sjZvRiX.exe
  C:\Windows\System\sjZvRiX.exe
  2⤵
  PID:6592
- C:\Windows\System\XnHUzbo.exe
  C:\Windows\System\XnHUzbo.exe
  2⤵
  PID:6364
- C:\Windows\System\LagnEsb.exe
  C:\Windows\System\LagnEsb.exe
  2⤵
  PID:6400
- C:\Windows\System\iEgAwBH.exe
  C:\Windows\System\iEgAwBH.exe
  2⤵
  PID:6416
- C:\Windows\System\DvCyTym.exe
  C:\Windows\System\DvCyTym.exe
  2⤵
  PID:6432
- C:\Windows\System\CfhbOav.exe
  C:\Windows\System\CfhbOav.exe
  2⤵
  PID:6448
- C:\Windows\System\GhmNVEr.exe
  C:\Windows\System\GhmNVEr.exe
  2⤵
  PID:6468
- C:\Windows\System\ooCHGKC.exe
  C:\Windows\System\ooCHGKC.exe
  2⤵
  PID:6548
- C:\Windows\System\klpEXfT.exe
  C:\Windows\System\klpEXfT.exe
  2⤵
  PID:6612
- C:\Windows\System\HEKcQeo.exe
  C:\Windows\System\HEKcQeo.exe
  2⤵
  PID:6660
- C:\Windows\System\QnkvVFh.exe
  C:\Windows\System\QnkvVFh.exe
  2⤵
  PID:6676
- C:\Windows\System\bpJfGnE.exe
  C:\Windows\System\bpJfGnE.exe
  2⤵
  PID:6692
- C:\Windows\System\CaOOwIJ.exe
  C:\Windows\System\CaOOwIJ.exe
  2⤵
  PID:6752
- C:\Windows\System\FRnyRgr.exe
  C:\Windows\System\FRnyRgr.exe
  2⤵
  PID:6748
- C:\Windows\System\dFEUVAH.exe
  C:\Windows\System\dFEUVAH.exe
  2⤵
  PID:6936
- C:\Windows\System\uWYpfCX.exe
  C:\Windows\System\uWYpfCX.exe
  2⤵
  PID:7000
- C:\Windows\System\nEQSXdH.exe
  C:\Windows\System\nEQSXdH.exe
  2⤵
  PID:7064
- C:\Windows\System\eVDfdeQ.exe
  C:\Windows\System\eVDfdeQ.exe
  2⤵
  PID:6860
- C:\Windows\System\oJNDlIJ.exe
  C:\Windows\System\oJNDlIJ.exe
  2⤵
  PID:6720
- C:\Windows\System\bkqPlzp.exe
  C:\Windows\System\bkqPlzp.exe
  2⤵
  PID:6820
- C:\Windows\System\aTrfEXg.exe
  C:\Windows\System\aTrfEXg.exe
  2⤵
  PID:7120
- C:\Windows\System\pPuSsQh.exe
  C:\Windows\System\pPuSsQh.exe
  2⤵
  PID:5572
- C:\Windows\System\bjLdXFY.exe
  C:\Windows\System\bjLdXFY.exe
  2⤵
  PID:6880
- C:\Windows\System\wrmKcuu.exe
  C:\Windows\System\wrmKcuu.exe
  2⤵
  PID:6648
- C:\Windows\System\BvMzfyB.exe
  C:\Windows\System\BvMzfyB.exe
  2⤵
  PID:5428
- C:\Windows\System\sWBrdWQ.exe
  C:\Windows\System\sWBrdWQ.exe
  2⤵
  PID:6800
- C:\Windows\System\WQqUrVr.exe
  C:\Windows\System\WQqUrVr.exe
  2⤵
  PID:6832
- C:\Windows\System\MGXqqVC.exe
  C:\Windows\System\MGXqqVC.exe
  2⤵
  PID:6852
- C:\Windows\System\iGQDbWI.exe
  C:\Windows\System\iGQDbWI.exe
  2⤵
  PID:6904
- C:\Windows\System\YNyjSgk.exe
  C:\Windows\System\YNyjSgk.exe
  2⤵
  PID:6952
- C:\Windows\System\kkeNKGl.exe
  C:\Windows\System\kkeNKGl.exe
  2⤵
  PID:7016
- C:\Windows\System\ukdAala.exe
  C:\Windows\System\ukdAala.exe
  2⤵
  PID:7080
- C:\Windows\System\QCatRis.exe
  C:\Windows\System\QCatRis.exe
  2⤵
  PID:7164
- C:\Windows\System\ayGgFvW.exe
  C:\Windows\System\ayGgFvW.exe
  2⤵
  PID:5584
- C:\Windows\System\GTPhnrb.exe
  C:\Windows\System\GTPhnrb.exe
  2⤵
  PID:5984
- C:\Windows\System\OWFaDRR.exe
  C:\Windows\System\OWFaDRR.exe
  2⤵
  PID:6444
- C:\Windows\System\uVrcIDN.exe
  C:\Windows\System\uVrcIDN.exe
  2⤵
  PID:6264
- C:\Windows\System\RGDrLHC.exe
  C:\Windows\System\RGDrLHC.exe
  2⤵
  PID:6300
- C:\Windows\System\UqhFWdc.exe
  C:\Windows\System\UqhFWdc.exe
  2⤵
  PID:6216
- C:\Windows\System\FyITXIU.exe
  C:\Windows\System\FyITXIU.exe
  2⤵
  PID:6280
- C:\Windows\System\ZzEtUbq.exe
  C:\Windows\System\ZzEtUbq.exe
  2⤵
  PID:6596
- C:\Windows\System\RBskHAM.exe
  C:\Windows\System\RBskHAM.exe
  2⤵
  PID:6528
- C:\Windows\System\SsofDFs.exe
  C:\Windows\System\SsofDFs.exe
  2⤵
  PID:5896
- C:\Windows\System\vlqJUxW.exe
  C:\Windows\System\vlqJUxW.exe
  2⤵
  PID:6632
- C:\Windows\System\ckpsdbI.exe
  C:\Windows\System\ckpsdbI.exe
  2⤵
  PID:6968
- C:\Windows\System\cEBNSjA.exe
  C:\Windows\System\cEBNSjA.exe
  2⤵
  PID:6712
- C:\Windows\System\RKAUHWF.exe
  C:\Windows\System\RKAUHWF.exe
  2⤵
  PID:6872
- C:\Windows\System\HeYhUgY.exe
  C:\Windows\System\HeYhUgY.exe
  2⤵
  PID:6892
- C:\Windows\System\oPveqtY.exe
  C:\Windows\System\oPveqtY.exe
  2⤵
  PID:6284
- C:\Windows\System\qaGBgFW.exe
  C:\Windows\System\qaGBgFW.exe
  2⤵
  PID:6488
- C:\Windows\System\uNuOlBm.exe
  C:\Windows\System\uNuOlBm.exe
  2⤵
  PID:6296
- C:\Windows\System\LvcWHhn.exe
  C:\Windows\System\LvcWHhn.exe
  2⤵
  PID:6312
- C:\Windows\System\WIRmncl.exe
  C:\Windows\System\WIRmncl.exe
  2⤵
  PID:6900
- C:\Windows\System\OpVjhdQ.exe
  C:\Windows\System\OpVjhdQ.exe
  2⤵
  PID:5364
- C:\Windows\System\YZNCkkE.exe
  C:\Windows\System\YZNCkkE.exe
  2⤵
  PID:6188
- C:\Windows\System\sVJcVcB.exe
  C:\Windows\System\sVJcVcB.exe
  2⤵
  PID:6836
- C:\Windows\System\KqngJlX.exe
  C:\Windows\System\KqngJlX.exe
  2⤵
  PID:6812
- C:\Windows\System\ARhJrOx.exe
  C:\Windows\System\ARhJrOx.exe
  2⤵
  PID:7032
- C:\Windows\System\EqOnHLc.exe
  C:\Windows\System\EqOnHLc.exe
  2⤵
  PID:6668
- C:\Windows\System\OFqsjrE.exe
  C:\Windows\System\OFqsjrE.exe
  2⤵
  PID:6544
- C:\Windows\System\xKFZKLG.exe
  C:\Windows\System\xKFZKLG.exe
  2⤵
  PID:6652
- C:\Windows\System\ZlMJXdI.exe
  C:\Windows\System\ZlMJXdI.exe
  2⤵
  PID:7152
- C:\Windows\System\PopMgLp.exe
  C:\Windows\System\PopMgLp.exe
  2⤵
  PID:6792
- C:\Windows\System\INUaaAq.exe
  C:\Windows\System\INUaaAq.exe
  2⤵
  PID:6724
- C:\Windows\System\LlvRgHj.exe
  C:\Windows\System\LlvRgHj.exe
  2⤵
  PID:6856
- C:\Windows\System\JYSbAHn.exe
  C:\Windows\System\JYSbAHn.exe
  2⤵
  PID:6172
- C:\Windows\System\jsQeaho.exe
  C:\Windows\System\jsQeaho.exe
  2⤵
  PID:7184
- C:\Windows\System\NrubnqZ.exe
  C:\Windows\System\NrubnqZ.exe
  2⤵
  PID:7200
- C:\Windows\System\jmddWLR.exe
  C:\Windows\System\jmddWLR.exe
  2⤵
  PID:7368
- C:\Windows\System\lXdQrXx.exe
  C:\Windows\System\lXdQrXx.exe
  2⤵
  PID:7384
- C:\Windows\System\MsiLrIF.exe
  C:\Windows\System\MsiLrIF.exe
  2⤵
  PID:7400
- C:\Windows\System\dtxbNnk.exe
  C:\Windows\System\dtxbNnk.exe
  2⤵
  PID:7420
- C:\Windows\System\PiBKEYY.exe
  C:\Windows\System\PiBKEYY.exe
  2⤵
  PID:7436
- C:\Windows\System\rMJKoOz.exe
  C:\Windows\System\rMJKoOz.exe
  2⤵
  PID:7452
- C:\Windows\System\oEqAEli.exe
  C:\Windows\System\oEqAEli.exe
  2⤵
  PID:7472
- C:\Windows\System\cFEbhQG.exe
  C:\Windows\System\cFEbhQG.exe
  2⤵
  PID:7488
- C:\Windows\System\hPjyarB.exe
  C:\Windows\System\hPjyarB.exe
  2⤵
  PID:7504
- C:\Windows\System\ugSuSIr.exe
  C:\Windows\System\ugSuSIr.exe
  2⤵
  PID:7524
- C:\Windows\System\ngOkMWf.exe
  C:\Windows\System\ngOkMWf.exe
  2⤵
  PID:7540
- C:\Windows\System\icfmfsL.exe
  C:\Windows\System\icfmfsL.exe
  2⤵
  PID:7556
- C:\Windows\System\enfcucD.exe
  C:\Windows\System\enfcucD.exe
  2⤵
  PID:7572
- C:\Windows\System\nxMQUGp.exe
  C:\Windows\System\nxMQUGp.exe
  2⤵
  PID:7720
- C:\Windows\System\QqfQqop.exe
  C:\Windows\System\QqfQqop.exe
  2⤵
  PID:7760
- C:\Windows\System\VTAdroG.exe
  C:\Windows\System\VTAdroG.exe
  2⤵
  PID:7780
- C:\Windows\System\tnwRYyU.exe
  C:\Windows\System\tnwRYyU.exe
  2⤵
  PID:7796
- C:\Windows\System\qMmYOjF.exe
  C:\Windows\System\qMmYOjF.exe
  2⤵
  PID:7812
- C:\Windows\System\WOArMzu.exe
  C:\Windows\System\WOArMzu.exe
  2⤵
  PID:7828
- C:\Windows\System\slFjlBS.exe
  C:\Windows\System\slFjlBS.exe
  2⤵
  PID:7844
- C:\Windows\System\STGrIFm.exe
  C:\Windows\System\STGrIFm.exe
  2⤵
  PID:7864
- C:\Windows\System\RkazxwT.exe
  C:\Windows\System\RkazxwT.exe
  2⤵
  PID:7880
- C:\Windows\System\yKYiJLe.exe
  C:\Windows\System\yKYiJLe.exe
  2⤵
  PID:7896
- C:\Windows\System\zJvXlHD.exe
  C:\Windows\System\zJvXlHD.exe
  2⤵
  PID:7916
- C:\Windows\System\MYcwfwH.exe
  C:\Windows\System\MYcwfwH.exe
  2⤵
  PID:7932
- C:\Windows\System\QAsyUBt.exe
  C:\Windows\System\QAsyUBt.exe
  2⤵
  PID:7948
- C:\Windows\System\mToBUYr.exe
  C:\Windows\System\mToBUYr.exe
  2⤵
  PID:7964
- C:\Windows\System\jZQrJDN.exe
  C:\Windows\System\jZQrJDN.exe
  2⤵
  PID:7980
- C:\Windows\System\GMsNlEp.exe
  C:\Windows\System\GMsNlEp.exe
  2⤵
  PID:8004
- C:\Windows\System\gKmpGMD.exe
  C:\Windows\System\gKmpGMD.exe
  2⤵
  PID:8020
- C:\Windows\System\tEcSNwd.exe
  C:\Windows\System\tEcSNwd.exe
  2⤵
  PID:8036
- C:\Windows\System\qXquhpD.exe
  C:\Windows\System\qXquhpD.exe
  2⤵
  PID:8056
- C:\Windows\System\afUojQN.exe
  C:\Windows\System\afUojQN.exe
  2⤵
  PID:8072
- C:\Windows\System\YfVvJhO.exe
  C:\Windows\System\YfVvJhO.exe
  2⤵
  PID:8088
- C:\Windows\System\zoRhRmY.exe
  C:\Windows\System\zoRhRmY.exe
  2⤵
  PID:8104
- C:\Windows\System\PAtjAvc.exe
  C:\Windows\System\PAtjAvc.exe
  2⤵
  PID:8124
- C:\Windows\System\SGqEvqq.exe
  C:\Windows\System\SGqEvqq.exe
  2⤵
  PID:8140
- C:\Windows\System\fidPeyO.exe
  C:\Windows\System\fidPeyO.exe
  2⤵
  PID:8156
- C:\Windows\System\vqHvMnP.exe
  C:\Windows\System\vqHvMnP.exe
  2⤵
  PID:8172
- C:\Windows\System\JsKwRbO.exe
  C:\Windows\System\JsKwRbO.exe
  2⤵
  PID:6828
- C:\Windows\System\gqfINpX.exe
  C:\Windows\System\gqfINpX.exe
  2⤵
  PID:7100
- C:\Windows\System\MOgGHPs.exe
  C:\Windows\System\MOgGHPs.exe
  2⤵
  PID:6460
- C:\Windows\System\OblFpuJ.exe
  C:\Windows\System\OblFpuJ.exe
  2⤵
  PID:6424
- C:\Windows\System\SbvcEjZ.exe
  C:\Windows\System\SbvcEjZ.exe
  2⤵
  PID:5200
- C:\Windows\System\LeuuWBR.exe
  C:\Windows\System\LeuuWBR.exe
  2⤵
  PID:6716
- C:\Windows\System\LyJoQut.exe
  C:\Windows\System\LyJoQut.exe
  2⤵
  PID:6412
- C:\Windows\System\KwPIFZr.exe
  C:\Windows\System\KwPIFZr.exe
  2⤵
  PID:6656
- C:\Windows\System\UkOBjtY.exe
  C:\Windows\System\UkOBjtY.exe
  2⤵
  PID:6064
- C:\Windows\System\wXyKqmN.exe
  C:\Windows\System\wXyKqmN.exe
  2⤵
  PID:6732
- C:\Windows\System\xIaZtKn.exe
  C:\Windows\System\xIaZtKn.exe
  2⤵
  PID:5784
- C:\Windows\System\ocXyfGw.exe
  C:\Windows\System\ocXyfGw.exe
  2⤵
  PID:6380
- C:\Windows\System\ZnFcdln.exe
  C:\Windows\System\ZnFcdln.exe
  2⤵
  PID:6492
- C:\Windows\System\djzopPs.exe
  C:\Windows\System\djzopPs.exe
  2⤵
  PID:7208
- C:\Windows\System\MIMJfHQ.exe
  C:\Windows\System\MIMJfHQ.exe
  2⤵
  PID:7216
- C:\Windows\System\FNIBbjB.exe
  C:\Windows\System\FNIBbjB.exe
  2⤵
  PID:7232
- C:\Windows\System\xoTXPiX.exe
  C:\Windows\System\xoTXPiX.exe
  2⤵
  PID:7244
- C:\Windows\System\YJfpQzT.exe
  C:\Windows\System\YJfpQzT.exe
  2⤵
  PID:7256
- C:\Windows\System\wfiSlGu.exe
  C:\Windows\System\wfiSlGu.exe
  2⤵
  PID:7284
- C:\Windows\System\gpiIcAX.exe
  C:\Windows\System\gpiIcAX.exe
  2⤵
  PID:7324
- C:\Windows\System\wcDnJOm.exe
  C:\Windows\System\wcDnJOm.exe
  2⤵
  PID:7340
- C:\Windows\System\uXdDJaB.exe
  C:\Windows\System\uXdDJaB.exe
  2⤵
  PID:7288
- C:\Windows\System\TQOanli.exe
  C:\Windows\System\TQOanli.exe
  2⤵
  PID:7428
- C:\Windows\System\RkQMPiC.exe
  C:\Windows\System\RkQMPiC.exe
  2⤵
  PID:1336
- C:\Windows\System\fCaHBkC.exe
  C:\Windows\System\fCaHBkC.exe
  2⤵
  PID:7496
- C:\Windows\System\OHSyIcB.exe
  C:\Windows\System\OHSyIcB.exe
  2⤵
  PID:7568
- C:\Windows\System\tlpMTTw.exe
  C:\Windows\System\tlpMTTw.exe
  2⤵
  PID:1956
- C:\Windows\System\banljSj.exe
  C:\Windows\System\banljSj.exe
  2⤵
  PID:2588
- C:\Windows\System\vvHSgQm.exe
  C:\Windows\System\vvHSgQm.exe
  2⤵
  PID:1948
- C:\Windows\System\erxyaOM.exe
  C:\Windows\System\erxyaOM.exe
  2⤵
  PID:7512
- C:\Windows\System\rLcOuCM.exe
  C:\Windows\System\rLcOuCM.exe
  2⤵
  PID:7376
- C:\Windows\System\TiiAAQU.exe
  C:\Windows\System\TiiAAQU.exe
  2⤵
  PID:7604
- C:\Windows\System\xrgsruz.exe
  C:\Windows\System\xrgsruz.exe
  2⤵
  PID:7408
- C:\Windows\System\uqiFsvG.exe
  C:\Windows\System\uqiFsvG.exe
  2⤵
  PID:7516
- C:\Windows\System\idBQuII.exe
  C:\Windows\System\idBQuII.exe
  2⤵
  PID:7652
- C:\Windows\System\VbZRxMq.exe
  C:\Windows\System\VbZRxMq.exe
  2⤵
  PID:7684
- C:\Windows\System\VfOKbvR.exe
  C:\Windows\System\VfOKbvR.exe
  2⤵
  PID:7708
- C:\Windows\System\majaOMR.exe
  C:\Windows\System\majaOMR.exe
  2⤵
  PID:7624
- C:\Windows\System\UMMVgjC.exe
  C:\Windows\System\UMMVgjC.exe
  2⤵
  PID:7648
- C:\Windows\System\rgXYnML.exe
  C:\Windows\System\rgXYnML.exe
  2⤵
  PID:7672
- C:\Windows\System\UiEQTjJ.exe
  C:\Windows\System\UiEQTjJ.exe
  2⤵
  PID:7736
- C:\Windows\System\XcgjzMV.exe
  C:\Windows\System\XcgjzMV.exe
  2⤵
  PID:7756
- C:\Windows\System\CnpBNVG.exe
  C:\Windows\System\CnpBNVG.exe
  2⤵
  PID:7824
- C:\Windows\System\BhapnaE.exe
  C:\Windows\System\BhapnaE.exe
  2⤵
  PID:7972
- C:\Windows\System\LgLLTQL.exe
  C:\Windows\System\LgLLTQL.exe
  2⤵
  PID:8028
- C:\Windows\System\qRtvDqL.exe
  C:\Windows\System\qRtvDqL.exe
  2⤵
  PID:8032
- C:\Windows\System\DlkfvDm.exe
  C:\Windows\System\DlkfvDm.exe
  2⤵
  PID:8096
- C:\Windows\System\zhAzeoC.exe
  C:\Windows\System\zhAzeoC.exe
  2⤵
  PID:7908
- C:\Windows\System\NVZAuLA.exe
  C:\Windows\System\NVZAuLA.exe
  2⤵
  PID:8120
- C:\Windows\System\BtbAbdL.exe
  C:\Windows\System\BtbAbdL.exe
  2⤵
  PID:8044
- C:\Windows\System\qVyYiWc.exe
  C:\Windows\System\qVyYiWc.exe
  2⤵
  PID:8112
- C:\Windows\System\YmnJzvB.exe
  C:\Windows\System\YmnJzvB.exe
  2⤵
  PID:7052
- C:\Windows\System\OHTNgQy.exe
  C:\Windows\System\OHTNgQy.exe
  2⤵
  PID:6908
- C:\Windows\System\plPBHcB.exe
  C:\Windows\System\plPBHcB.exe
  2⤵
  PID:6684
- C:\Windows\System\SOezmnv.exe
  C:\Windows\System\SOezmnv.exe
  2⤵
  PID:8180
- C:\Windows\System\qnTpOsk.exe
  C:\Windows\System\qnTpOsk.exe
  2⤵
  PID:7276
- C:\Windows\System\bMAKRSv.exe
  C:\Windows\System\bMAKRSv.exe
  2⤵
  PID:6984
- C:\Windows\System\QuRXSVN.exe
  C:\Windows\System\QuRXSVN.exe
  2⤵
  PID:6988
- C:\Windows\System\KSaPQsg.exe
  C:\Windows\System\KSaPQsg.exe
  2⤵
  PID:6244
- C:\Windows\System\hSfWGJn.exe
  C:\Windows\System\hSfWGJn.exe
  2⤵
  PID:7264
- C:\Windows\System\zitFRxN.exe
  C:\Windows\System\zitFRxN.exe
  2⤵
  PID:7220
- C:\Windows\System\nJyfEsS.exe
  C:\Windows\System\nJyfEsS.exe
  2⤵
  PID:7280
- C:\Windows\System\RTbbzOk.exe
  C:\Windows\System\RTbbzOk.exe
  2⤵
  PID:7332
- C:\Windows\System\fVFzuYk.exe
  C:\Windows\System\fVFzuYk.exe
  2⤵
  PID:368
- C:\Windows\System\yqPnTOk.exe
  C:\Windows\System\yqPnTOk.exe
  2⤵
  PID:7460
- C:\Windows\System\CSUSFyf.exe
  C:\Windows\System\CSUSFyf.exe
  2⤵
  PID:7480
- C:\Windows\System\XBuGEHe.exe
  C:\Windows\System\XBuGEHe.exe
  2⤵
  PID:2760
- C:\Windows\System\CUOWdkT.exe
  C:\Windows\System\CUOWdkT.exe
  2⤵
  PID:7668
- C:\Windows\System\rpwRApr.exe
  C:\Windows\System\rpwRApr.exe
  2⤵
  PID:7692
- C:\Windows\System\TEyHfGt.exe
  C:\Windows\System\TEyHfGt.exe
  2⤵
  PID:7628
- C:\Windows\System\EFMUxgT.exe
  C:\Windows\System\EFMUxgT.exe
  2⤵
  PID:7696
- C:\Windows\System\npPNOwR.exe
  C:\Windows\System\npPNOwR.exe
  2⤵
  PID:7820
- C:\Windows\System\QdIMyDP.exe
  C:\Windows\System\QdIMyDP.exe
  2⤵
  PID:7768
- C:\Windows\System\RjxsGUj.exe
  C:\Windows\System\RjxsGUj.exe
  2⤵
  PID:8100
- C:\Windows\System\SbPhumD.exe
  C:\Windows\System\SbPhumD.exe
  2⤵
  PID:8116
- C:\Windows\System\TzOLPav.exe
  C:\Windows\System\TzOLPav.exe
  2⤵
  PID:7196
- C:\Windows\System\wotfEqu.exe
  C:\Windows\System\wotfEqu.exe
  2⤵
  PID:7888
- C:\Windows\System\rDhojfN.exe
  C:\Windows\System\rDhojfN.exe
  2⤵
  PID:6212
- C:\Windows\System\smJuUBm.exe
  C:\Windows\System\smJuUBm.exe
  2⤵
  PID:7048
- C:\Windows\System\ISGlSik.exe
  C:\Windows\System\ISGlSik.exe
  2⤵
  PID:6772
- C:\Windows\System\vkdytLS.exe
  C:\Windows\System\vkdytLS.exe
  2⤵
  PID:7600
- C:\Windows\System\uKgNCSG.exe
  C:\Windows\System\uKgNCSG.exe
  2⤵
  PID:7588
- C:\Windows\System\FzXVDWO.exe
  C:\Windows\System\FzXVDWO.exe
  2⤵
  PID:7108
- C:\Windows\System\EucQzmV.exe
  C:\Windows\System\EucQzmV.exe
  2⤵
  PID:7580
- C:\Windows\System\SdNGwnL.exe
  C:\Windows\System\SdNGwnL.exe
  2⤵
  PID:7716
- C:\Windows\System\MEdeknX.exe
  C:\Windows\System\MEdeknX.exe
  2⤵
  PID:8168
- C:\Windows\System\NAbqUFA.exe
  C:\Windows\System\NAbqUFA.exe
  2⤵
  PID:7912
- C:\Windows\System\FRLJxqJ.exe
  C:\Windows\System\FRLJxqJ.exe
  2⤵
  PID:7240
- C:\Windows\System\SBWzswO.exe
  C:\Windows\System\SBWzswO.exe
  2⤵
  PID:8188
- C:\Windows\System\zZmuDRK.exe
  C:\Windows\System\zZmuDRK.exe
  2⤵
  PID:7228
- C:\Windows\System\DgLHYDk.exe
  C:\Windows\System\DgLHYDk.exe
  2⤵
  PID:7300
- C:\Windows\System\xgJwVSo.exe
  C:\Windows\System\xgJwVSo.exe
  2⤵
  PID:7840
- C:\Windows\System\sqZIPUC.exe
  C:\Windows\System\sqZIPUC.exe
  2⤵
  PID:7776
- C:\Windows\System\BbzJKKw.exe
  C:\Windows\System\BbzJKKw.exe
  2⤵
  PID:7996
- C:\Windows\System\fJxCyxh.exe
  C:\Windows\System\fJxCyxh.exe
  2⤵
  PID:7956
- C:\Windows\System\HGurTDf.exe
  C:\Windows\System\HGurTDf.exe
  2⤵
  PID:7792
- C:\Windows\System\zleimWc.exe
  C:\Windows\System\zleimWc.exe
  2⤵
  PID:7260
- C:\Windows\System\RaFjGKt.exe
  C:\Windows\System\RaFjGKt.exe
  2⤵
  PID:8084
- C:\Windows\System\TTrJcjP.exe
  C:\Windows\System\TTrJcjP.exe
  2⤵
  PID:5808
- C:\Windows\System\ouBnIZM.exe
  C:\Windows\System\ouBnIZM.exe
  2⤵
  PID:7296
- C:\Windows\System\dsHhUBr.exe
  C:\Windows\System\dsHhUBr.exe
  2⤵
  PID:7644
- C:\Windows\System\qQgZNOW.exe
  C:\Windows\System\qQgZNOW.exe
  2⤵
  PID:7616
- C:\Windows\System\ujUnPuJ.exe
  C:\Windows\System\ujUnPuJ.exe
  2⤵
  PID:7612
- C:\Windows\System\fUTKvHt.exe
  C:\Windows\System\fUTKvHt.exe
  2⤵
  PID:7804
- C:\Windows\System\GohUpUg.exe
  C:\Windows\System\GohUpUg.exe
  2⤵
  PID:7412
- C:\Windows\System\iLPKHOA.exe
  C:\Windows\System\iLPKHOA.exe
  2⤵
  PID:6768
- C:\Windows\System\YIUwwDx.exe
  C:\Windows\System\YIUwwDx.exe
  2⤵
  PID:7704
- C:\Windows\System\ZMCtRTp.exe
  C:\Windows\System\ZMCtRTp.exe
  2⤵
  PID:7248
- C:\Windows\System\PNABoOp.exe
  C:\Windows\System\PNABoOp.exe
  2⤵
  PID:8016
- C:\Windows\System\QkZIsIU.exe
  C:\Windows\System\QkZIsIU.exe
  2⤵
  PID:7192
- C:\Windows\System\VVjxAoX.exe
  C:\Windows\System\VVjxAoX.exe
  2⤵
  PID:7432
- C:\Windows\System\XDPykcD.exe
  C:\Windows\System\XDPykcD.exe
  2⤵
  PID:8220
- C:\Windows\System\PwcGNFA.exe
  C:\Windows\System\PwcGNFA.exe
  2⤵
  PID:8240
- C:\Windows\System\fWhboqc.exe
  C:\Windows\System\fWhboqc.exe
  2⤵
  PID:8256
- C:\Windows\System\qomdcSI.exe
  C:\Windows\System\qomdcSI.exe
  2⤵
  PID:8272
- C:\Windows\System\TELtFca.exe
  C:\Windows\System\TELtFca.exe
  2⤵
  PID:8288
- C:\Windows\System\rKRFgRs.exe
  C:\Windows\System\rKRFgRs.exe
  2⤵
  PID:8304
- C:\Windows\System\ovjOfuA.exe
  C:\Windows\System\ovjOfuA.exe
  2⤵
  PID:8320
- C:\Windows\System\gavpkLL.exe
  C:\Windows\System\gavpkLL.exe
  2⤵
  PID:8336
- C:\Windows\System\dLtjgQf.exe
  C:\Windows\System\dLtjgQf.exe
  2⤵
  PID:8352
- C:\Windows\System\EIgCQVn.exe
  C:\Windows\System\EIgCQVn.exe
  2⤵
  PID:8368
- C:\Windows\System\IfltlVj.exe
  C:\Windows\System\IfltlVj.exe
  2⤵
  PID:8420
- C:\Windows\System\pyOQPWX.exe
  C:\Windows\System\pyOQPWX.exe
  2⤵
  PID:8436
- C:\Windows\System\UMhItZO.exe
  C:\Windows\System\UMhItZO.exe
  2⤵
  PID:8452
- C:\Windows\System\FbcavbQ.exe
  C:\Windows\System\FbcavbQ.exe
  2⤵
  PID:8468
- C:\Windows\System\IzmLoiV.exe
  C:\Windows\System\IzmLoiV.exe
  2⤵
  PID:8484
- C:\Windows\System\rTuDKjY.exe
  C:\Windows\System\rTuDKjY.exe
  2⤵
  PID:8500
- C:\Windows\System\wejBncV.exe
  C:\Windows\System\wejBncV.exe
  2⤵
  PID:8516
- C:\Windows\System\vYdPMva.exe
  C:\Windows\System\vYdPMva.exe
  2⤵
  PID:8532
- C:\Windows\System\GDQQhjg.exe
  C:\Windows\System\GDQQhjg.exe
  2⤵
  PID:8548
- C:\Windows\System\bKPpRmx.exe
  C:\Windows\System\bKPpRmx.exe
  2⤵
  PID:8564
- C:\Windows\System\OMpwvXl.exe
  C:\Windows\System\OMpwvXl.exe
  2⤵
  PID:8580
- C:\Windows\System\vJRtpXO.exe
  C:\Windows\System\vJRtpXO.exe
  2⤵
  PID:8596
- C:\Windows\System\TOzUHtM.exe
  C:\Windows\System\TOzUHtM.exe
  2⤵
  PID:8612
- C:\Windows\System\BDhsVgI.exe
  C:\Windows\System\BDhsVgI.exe
  2⤵
  PID:8628
- C:\Windows\System\PQKADXs.exe
  C:\Windows\System\PQKADXs.exe
  2⤵
  PID:8648
- C:\Windows\System\ZZIcXKd.exe
  C:\Windows\System\ZZIcXKd.exe
  2⤵
  PID:8664
- C:\Windows\System\LwopuBG.exe
  C:\Windows\System\LwopuBG.exe
  2⤵
  PID:8680
- C:\Windows\System\JlTLTik.exe
  C:\Windows\System\JlTLTik.exe
  2⤵
  PID:8704
- C:\Windows\System\ntGtewN.exe
  C:\Windows\System\ntGtewN.exe
  2⤵
  PID:8720
- C:\Windows\System\GBMVLKr.exe
  C:\Windows\System\GBMVLKr.exe
  2⤵
  PID:8740
- C:\Windows\System\bDEifsQ.exe
  C:\Windows\System\bDEifsQ.exe
  2⤵
  PID:8756
- C:\Windows\System\sluEARE.exe
  C:\Windows\System\sluEARE.exe
  2⤵
  PID:8772
- C:\Windows\System\RwbPaok.exe
  C:\Windows\System\RwbPaok.exe
  2⤵
  PID:8788
- C:\Windows\System\GPZHdhn.exe
  C:\Windows\System\GPZHdhn.exe
  2⤵
  PID:8804
- C:\Windows\System\ddsGUtd.exe
  C:\Windows\System\ddsGUtd.exe
  2⤵
  PID:8872
- C:\Windows\System\kobEpKK.exe
  C:\Windows\System\kobEpKK.exe
  2⤵
  PID:8896
- C:\Windows\System\MWGhkiF.exe
  C:\Windows\System\MWGhkiF.exe
  2⤵
  PID:8912
- C:\Windows\System\irTczgZ.exe
  C:\Windows\System\irTczgZ.exe
  2⤵
  PID:8928
- C:\Windows\System\fhRqhVc.exe
  C:\Windows\System\fhRqhVc.exe
  2⤵
  PID:8944
- C:\Windows\System\sQxDTWl.exe
  C:\Windows\System\sQxDTWl.exe
  2⤵
  PID:8968
- C:\Windows\System\HghQjyC.exe
  C:\Windows\System\HghQjyC.exe
  2⤵
  PID:9068
- C:\Windows\System\xvgQmCe.exe
  C:\Windows\System\xvgQmCe.exe
  2⤵
  PID:9084
- C:\Windows\System\SJKhWyA.exe
  C:\Windows\System\SJKhWyA.exe
  2⤵
  PID:9100
- C:\Windows\System\MFpEJHB.exe
  C:\Windows\System\MFpEJHB.exe
  2⤵
  PID:9160
- C:\Windows\System\URkEdHA.exe
  C:\Windows\System\URkEdHA.exe
  2⤵
  PID:9176
- C:\Windows\System\EgCErwz.exe
  C:\Windows\System\EgCErwz.exe
  2⤵
  PID:9196
- C:\Windows\System\csuVNQq.exe
  C:\Windows\System\csuVNQq.exe
  2⤵
  PID:7988
- C:\Windows\System\XXvjEBp.exe
  C:\Windows\System\XXvjEBp.exe
  2⤵
  PID:8208
- C:\Windows\System\WQYkTxf.exe
  C:\Windows\System\WQYkTxf.exe
  2⤵
  PID:8280
- C:\Windows\System\wnFEYkH.exe
  C:\Windows\System\wnFEYkH.exe
  2⤵
  PID:8316
- C:\Windows\System\KAWgBwh.exe
  C:\Windows\System\KAWgBwh.exe
  2⤵
  PID:8384
- C:\Windows\System\jbItJyi.exe
  C:\Windows\System\jbItJyi.exe
  2⤵
  PID:8448
- C:\Windows\System\iMGhJLd.exe
  C:\Windows\System\iMGhJLd.exe
  2⤵
  PID:8264
- C:\Windows\System\ATnGEOL.exe
  C:\Windows\System\ATnGEOL.exe
  2⤵
  PID:8748
- C:\Windows\System\CSmdVCD.exe
  C:\Windows\System\CSmdVCD.exe
  2⤵
  PID:8984
- C:\Windows\System\LdJaTfI.exe
  C:\Windows\System\LdJaTfI.exe
  2⤵
  PID:9000
- C:\Windows\System\uVmjQRF.exe
  C:\Windows\System\uVmjQRF.exe
  2⤵
  PID:9044
- C:\Windows\System\JzTktSq.exe
  C:\Windows\System\JzTktSq.exe
  2⤵
  PID:8964
- C:\Windows\System\cfRJDvP.exe
  C:\Windows\System\cfRJDvP.exe
  2⤵
  PID:8800
- C:\Windows\System\MuxirRM.exe
  C:\Windows\System\MuxirRM.exe
  2⤵
  PID:9152
- C:\Windows\System\VOiZxNJ.exe
  C:\Windows\System\VOiZxNJ.exe
  2⤵
  PID:8196
- C:\Windows\System\CkNGeQs.exe
  C:\Windows\System\CkNGeQs.exe
  2⤵
  PID:7352
- C:\Windows\System\lOuJjIT.exe
  C:\Windows\System\lOuJjIT.exe
  2⤵
  PID:8540
- C:\Windows\System\jpXjLvA.exe
  C:\Windows\System\jpXjLvA.exe
  2⤵
  PID:8052
- C:\Windows\System\KCCMVBu.exe
  C:\Windows\System\KCCMVBu.exe
  2⤵
  PID:1488
- C:\Windows\System\KbwIuQb.exe
  C:\Windows\System\KbwIuQb.exe
  2⤵
  PID:8364
- C:\Windows\System\ISLgIOu.exe
  C:\Windows\System\ISLgIOu.exe
  2⤵
  PID:8328
- C:\Windows\System\sYatiiE.exe
  C:\Windows\System\sYatiiE.exe
  2⤵
  PID:8228
- C:\Windows\System\tCtrYfq.exe
  C:\Windows\System\tCtrYfq.exe
  2⤵
  PID:9120
- C:\Windows\System\WvqMruz.exe
  C:\Windows\System\WvqMruz.exe
  2⤵
  PID:8528
- C:\Windows\System\nvEQldK.exe
  C:\Windows\System\nvEQldK.exe
  2⤵
  PID:8676
- C:\Windows\System\LFKkQZd.exe
  C:\Windows\System\LFKkQZd.exe
  2⤵
  PID:8656
- C:\Windows\System\qBnzyvI.exe
  C:\Windows\System\qBnzyvI.exe
  2⤵
  PID:8752
- C:\Windows\System\tgkglqK.exe
  C:\Windows\System\tgkglqK.exe
  2⤵
  PID:7396
- C:\Windows\System\OmMpkKS.exe
  C:\Windows\System\OmMpkKS.exe
  2⤵
  PID:5432
- C:\Windows\System\zjhRunG.exe
  C:\Windows\System\zjhRunG.exe
  2⤵
  PID:8908
- C:\Windows\System\KRFeavo.exe
  C:\Windows\System\KRFeavo.exe
  2⤵
  PID:5604
- C:\Windows\System\JhySwFr.exe
  C:\Windows\System\JhySwFr.exe
  2⤵
  PID:8940
- C:\Windows\System\xJgUGbD.exe
  C:\Windows\System\xJgUGbD.exe
  2⤵
  PID:9012
- C:\Windows\System\tjDtTms.exe
  C:\Windows\System\tjDtTms.exe
  2⤵
  PID:9192
- C:\Windows\System\UwXVFVA.exe
  C:\Windows\System\UwXVFVA.exe
  2⤵
  PID:9124
- C:\Windows\System\pqNUSBv.exe
  C:\Windows\System\pqNUSBv.exe
  2⤵
  PID:8508
- C:\Windows\System\lOzrNbP.exe
  C:\Windows\System\lOzrNbP.exe
  2⤵
  PID:8432
- C:\Windows\System\GZQGmJe.exe
  C:\Windows\System\GZQGmJe.exe
  2⤵
  PID:8388
- C:\Windows\System\PswuPEO.exe
  C:\Windows\System\PswuPEO.exe
  2⤵
  PID:8636
- C:\Windows\System\gOVYhYW.exe
  C:\Windows\System\gOVYhYW.exe
  2⤵
  PID:8444
- C:\Windows\System\bEueEBr.exe
  C:\Windows\System\bEueEBr.exe
  2⤵
  PID:8464
- C:\Windows\System\zhfJyhI.exe
  C:\Windows\System\zhfJyhI.exe
  2⤵
  PID:8696
- C:\Windows\System\kgRrwpk.exe
  C:\Windows\System\kgRrwpk.exe
  2⤵
  PID:8716
- C:\Windows\System\aNUounn.exe
  C:\Windows\System\aNUounn.exe
  2⤵
  PID:8620
- C:\Windows\System\sXKdCiL.exe
  C:\Windows\System\sXKdCiL.exe
  2⤵
  PID:8624
- C:\Windows\System\eAaYcdO.exe
  C:\Windows\System\eAaYcdO.exe
  2⤵
  PID:9116
- C:\Windows\System\DznLiPf.exe
  C:\Windows\System\DznLiPf.exe
  2⤵
  PID:8376
- C:\Windows\System\GFqpfFM.exe
  C:\Windows\System\GFqpfFM.exe
  2⤵
  PID:8360
- C:\Windows\System\SDMfxbz.exe
  C:\Windows\System\SDMfxbz.exe
  2⤵
  PID:9208
- C:\Windows\System\MXNmhKc.exe
  C:\Windows\System\MXNmhKc.exe
  2⤵
  PID:9028
- C:\Windows\System\xcLBmmZ.exe
  C:\Windows\System\xcLBmmZ.exe
  2⤵
  PID:9148
- C:\Windows\System\oRZfDFw.exe
  C:\Windows\System\oRZfDFw.exe
  2⤵
  PID:9024
- C:\Windows\System\zFfXTve.exe
  C:\Windows\System\zFfXTve.exe
  2⤵
  PID:9052
- C:\Windows\System\hgvUPyL.exe
  C:\Windows\System\hgvUPyL.exe
  2⤵
  PID:8492
- C:\Windows\System\ZOunmfZ.exe
  C:\Windows\System\ZOunmfZ.exe
  2⤵
  PID:9140
- C:\Windows\System\gHEUTkZ.exe
  C:\Windows\System\gHEUTkZ.exe
  2⤵
  PID:8312
- C:\Windows\System\OWvuYRs.exe
  C:\Windows\System\OWvuYRs.exe
  2⤵
  PID:8644
- C:\Windows\System\yvYUgxx.exe
  C:\Windows\System\yvYUgxx.exe
  2⤵
  PID:9092
- C:\Windows\System\LFfmhhf.exe
  C:\Windows\System\LFfmhhf.exe
  2⤵
  PID:9168
- C:\Windows\System\khvmRBw.exe
  C:\Windows\System\khvmRBw.exe
  2⤵
  PID:8348
- C:\Windows\System\gzhDqiI.exe
  C:\Windows\System\gzhDqiI.exe
  2⤵
  PID:9184
- C:\Windows\System\yEmoWmT.exe
  C:\Windows\System\yEmoWmT.exe
  2⤵
  PID:8688
- C:\Windows\System\bmQpXeY.exe
  C:\Windows\System\bmQpXeY.exe
  2⤵
  PID:8892
- C:\Windows\System\VPCfzvE.exe
  C:\Windows\System\VPCfzvE.exe
  2⤵
  PID:9096
- C:\Windows\System\bnramnw.exe
  C:\Windows\System\bnramnw.exe
  2⤵
  PID:7664
- C:\Windows\System\zByooPs.exe
  C:\Windows\System\zByooPs.exe
  2⤵
  PID:8236
- C:\Windows\System\rnWQfLs.exe
  C:\Windows\System\rnWQfLs.exe
  2⤵
  PID:8248
- C:\Windows\System\WVprvLK.exe
  C:\Windows\System\WVprvLK.exe
  2⤵
  PID:8252
- C:\Windows\System\GoPXPiO.exe
  C:\Windows\System\GoPXPiO.exe
  2⤵
  PID:9040
- C:\Windows\System\YwsPOxb.exe
  C:\Windows\System\YwsPOxb.exe
  2⤵
  PID:8796
- C:\Windows\System\JWUTQbG.exe
  C:\Windows\System\JWUTQbG.exe
  2⤵
  PID:9204
- C:\Windows\System\RzrCYQv.exe
  C:\Windows\System\RzrCYQv.exe
  2⤵
  PID:8672
- C:\Windows\System\yXlZIzX.exe
  C:\Windows\System\yXlZIzX.exe
  2⤵
  PID:8412
- C:\Windows\System\UXnZaxd.exe
  C:\Windows\System\UXnZaxd.exe
  2⤵
  PID:7752
- C:\Windows\System\zVYDlvJ.exe
  C:\Windows\System\zVYDlvJ.exe
  2⤵
  PID:8408
- C:\Windows\System\wMfBDuT.exe
  C:\Windows\System\wMfBDuT.exe
  2⤵
  PID:9228
- C:\Windows\System\gBfmIkE.exe
  C:\Windows\System\gBfmIkE.exe
  2⤵
  PID:9248
- C:\Windows\System\eWeymOl.exe
  C:\Windows\System\eWeymOl.exe
  2⤵
  PID:9272
- C:\Windows\System\xscpWyI.exe
  C:\Windows\System\xscpWyI.exe
  2⤵
  PID:9304
- C:\Windows\System\GUcKvlc.exe
  C:\Windows\System\GUcKvlc.exe
  2⤵
  PID:9320
- C:\Windows\System\aolPkWt.exe
  C:\Windows\System\aolPkWt.exe
  2⤵
  PID:9336
- C:\Windows\System\KZkdzLU.exe
  C:\Windows\System\KZkdzLU.exe
  2⤵
  PID:9352
- C:\Windows\System\imvZLlK.exe
  C:\Windows\System\imvZLlK.exe
  2⤵
  PID:9368
- C:\Windows\System\JytUVwG.exe
  C:\Windows\System\JytUVwG.exe
  2⤵
  PID:9384
- C:\Windows\System\nHTLwGt.exe
  C:\Windows\System\nHTLwGt.exe
  2⤵
  PID:9400
- C:\Windows\System\caJXQeu.exe
  C:\Windows\System\caJXQeu.exe
  2⤵
  PID:9416
- C:\Windows\System\QkvNuLl.exe
  C:\Windows\System\QkvNuLl.exe
  2⤵
  PID:9440
- C:\Windows\System\nuPWuOP.exe
  C:\Windows\System\nuPWuOP.exe
  2⤵
  PID:9456
- C:\Windows\System\yIPWNNs.exe
  C:\Windows\System\yIPWNNs.exe
  2⤵
  PID:9472
- C:\Windows\System\ZEWzrJr.exe
  C:\Windows\System\ZEWzrJr.exe
  2⤵
  PID:9488
- C:\Windows\System\eVELEiK.exe
  C:\Windows\System\eVELEiK.exe
  2⤵
  PID:9508
- C:\Windows\System\eYeGTcw.exe
  C:\Windows\System\eYeGTcw.exe
  2⤵
  PID:9528
- C:\Windows\System\XPvTfZC.exe
  C:\Windows\System\XPvTfZC.exe
  2⤵
  PID:9548
- C:\Windows\System\rPYkVMr.exe
  C:\Windows\System\rPYkVMr.exe
  2⤵
  PID:9564
- C:\Windows\System\ZWmRpbo.exe
  C:\Windows\System\ZWmRpbo.exe
  2⤵
  PID:9580
- C:\Windows\System\jJcEOiX.exe
  C:\Windows\System\jJcEOiX.exe
  2⤵
  PID:9596
- C:\Windows\System\arPtdBo.exe
  C:\Windows\System\arPtdBo.exe
  2⤵
  PID:9612
- C:\Windows\System\EbMOHvm.exe
  C:\Windows\System\EbMOHvm.exe
  2⤵
  PID:9628
- C:\Windows\System\SoGAbxs.exe
  C:\Windows\System\SoGAbxs.exe
  2⤵
  PID:9644
- C:\Windows\System\voZVzpL.exe
  C:\Windows\System\voZVzpL.exe
  2⤵
  PID:9748
- C:\Windows\System\BWKSWji.exe
  C:\Windows\System\BWKSWji.exe
  2⤵
  PID:9764
- C:\Windows\System\adzKELb.exe
  C:\Windows\System\adzKELb.exe
  2⤵
  PID:9800
- C:\Windows\System\TIhZBPt.exe
  C:\Windows\System\TIhZBPt.exe
  2⤵
  PID:9872
- C:\Windows\System\IFEdBpf.exe
  C:\Windows\System\IFEdBpf.exe
  2⤵
  PID:9892
- C:\Windows\System\XJypsfU.exe
  C:\Windows\System\XJypsfU.exe
  2⤵
  PID:9908
- C:\Windows\System\YbuuWss.exe
  C:\Windows\System\YbuuWss.exe
  2⤵
  PID:9924
- C:\Windows\System\UqrLNrB.exe
  C:\Windows\System\UqrLNrB.exe
  2⤵
  PID:9944
- C:\Windows\System\bpqJgSA.exe
  C:\Windows\System\bpqJgSA.exe
  2⤵
  PID:9960
- C:\Windows\System\XAPwfzs.exe
  C:\Windows\System\XAPwfzs.exe
  2⤵
  PID:9976
- C:\Windows\System\dlpIBgt.exe
  C:\Windows\System\dlpIBgt.exe
  2⤵
  PID:9992
- C:\Windows\System\XJlGJYX.exe
  C:\Windows\System\XJlGJYX.exe
  2⤵
  PID:10008
- C:\Windows\System\UCLEHVL.exe
  C:\Windows\System\UCLEHVL.exe
  2⤵
  PID:10028
- C:\Windows\System\VzNSNcd.exe
  C:\Windows\System\VzNSNcd.exe
  2⤵
  PID:10140
- C:\Windows\System\owpBBtn.exe
  C:\Windows\System\owpBBtn.exe
  2⤵
  PID:10156
- C:\Windows\System\uFmVewj.exe
  C:\Windows\System\uFmVewj.exe
  2⤵
  PID:10176
- C:\Windows\System\zEDBMKA.exe
  C:\Windows\System\zEDBMKA.exe
  2⤵
  PID:10192
- C:\Windows\System\PbJCVtQ.exe
  C:\Windows\System\PbJCVtQ.exe
  2⤵
  PID:10208
- C:\Windows\System\VUVwaFC.exe
  C:\Windows\System\VUVwaFC.exe
  2⤵
  PID:10228
- C:\Windows\System\CtURXWA.exe
  C:\Windows\System\CtURXWA.exe
  2⤵
  PID:9236
- C:\Windows\System\QYnTGoF.exe
  C:\Windows\System\QYnTGoF.exe
  2⤵
  PID:1448
- C:\Windows\System\tOSWNen.exe
  C:\Windows\System\tOSWNen.exe
  2⤵
  PID:9296
- C:\Windows\System\VOsNcxU.exe
  C:\Windows\System\VOsNcxU.exe
  2⤵
  PID:9396
- C:\Windows\System\SDDOvgO.exe
  C:\Windows\System\SDDOvgO.exe
  2⤵
  PID:9008
- C:\Windows\System\LGvMrKV.exe
  C:\Windows\System\LGvMrKV.exe
  2⤵
  PID:9260
- C:\Windows\System\vGGPVpd.exe
  C:\Windows\System\vGGPVpd.exe
  2⤵
  PID:9436
- C:\Windows\System\jQKGnZH.exe
  C:\Windows\System\jQKGnZH.exe
  2⤵
  PID:9376
- C:\Windows\System\CfaKomy.exe
  C:\Windows\System\CfaKomy.exe
  2⤵
  PID:9224
- C:\Windows\System\wXcZyCX.exe
  C:\Windows\System\wXcZyCX.exe
  2⤵
  PID:9504
- C:\Windows\System\rDQkZYh.exe
  C:\Windows\System\rDQkZYh.exe
  2⤵
  PID:9380
- C:\Windows\System\fveCWqS.exe
  C:\Windows\System\fveCWqS.exe
  2⤵
  PID:9268
- C:\Windows\System\KwDrDRj.exe
  C:\Windows\System\KwDrDRj.exe
  2⤵
  PID:9448
- C:\Windows\System\EWKPlsn.exe
  C:\Windows\System\EWKPlsn.exe
  2⤵
  PID:9432
- C:\Windows\System\nFDoGYw.exe
  C:\Windows\System\nFDoGYw.exe
  2⤵
  PID:944
- C:\Windows\System\ILDcTbp.exe
  C:\Windows\System\ILDcTbp.exe
  2⤵
  PID:9816
- C:\Windows\System\bvgneEN.exe
  C:\Windows\System\bvgneEN.exe
  2⤵
  PID:9668
- C:\Windows\System\DVlNRxV.exe
  C:\Windows\System\DVlNRxV.exe
  2⤵
  PID:9692
- C:\Windows\System\WghKJCK.exe
  C:\Windows\System\WghKJCK.exe
  2⤵
  PID:9708
- C:\Windows\System\KRbFXZe.exe
  C:\Windows\System\KRbFXZe.exe
  2⤵
  PID:9840
- C:\Windows\System\iFxFzpX.exe
  C:\Windows\System\iFxFzpX.exe
  2⤵
  PID:9796
- C:\Windows\System\fuzukvM.exe
  C:\Windows\System\fuzukvM.exe
  2⤵
  PID:9836
- C:\Windows\System\KRjyIYm.exe
  C:\Windows\System\KRjyIYm.exe
  2⤵
  PID:10000
- C:\Windows\System\qEiCFPi.exe
  C:\Windows\System\qEiCFPi.exe
  2⤵
  PID:10044
- C:\Windows\System\xiOKave.exe
  C:\Windows\System\xiOKave.exe
  2⤵
  PID:10068
- C:\Windows\System\hKbsFjR.exe
  C:\Windows\System\hKbsFjR.exe
  2⤵
  PID:10084
- C:\Windows\System\TlgOAhP.exe
  C:\Windows\System\TlgOAhP.exe
  2⤵
  PID:9716
- C:\Windows\System\kQTtONj.exe
  C:\Windows\System\kQTtONj.exe
  2⤵
  PID:10124
- C:\Windows\System\UlIEBUu.exe
  C:\Windows\System\UlIEBUu.exe
  2⤵
  PID:10164
- C:\Windows\System\zwLLvzb.exe
  C:\Windows\System\zwLLvzb.exe
  2⤵
  PID:9956
- C:\Windows\System\YpvCdiB.exe
  C:\Windows\System\YpvCdiB.exe
  2⤵
  PID:10172
- C:\Windows\System\KOHXLZe.exe
  C:\Windows\System\KOHXLZe.exe
  2⤵
  PID:10204
- C:\Windows\System\yVDXyMo.exe
  C:\Windows\System\yVDXyMo.exe
  2⤵
  PID:924
- C:\Windows\System\fySOKSk.exe
  C:\Windows\System\fySOKSk.exe
  2⤵
  PID:920
- C:\Windows\System\dgqyYQB.exe
  C:\Windows\System\dgqyYQB.exe
  2⤵
  PID:9244
- C:\Windows\System\ATqjnyT.exe
  C:\Windows\System\ATqjnyT.exe
  2⤵
  PID:9288
- C:\Windows\System\TaoUSxN.exe
  C:\Windows\System\TaoUSxN.exe
  2⤵
  PID:9220
- C:\Windows\System\HHQQQUN.exe
  C:\Windows\System\HHQQQUN.exe
  2⤵
  PID:9516
- C:\Windows\System\hNQNzlL.exe
  C:\Windows\System\hNQNzlL.exe
  2⤵
  PID:9604
- C:\Windows\System\gUleMxt.exe
  C:\Windows\System\gUleMxt.exe
  2⤵
  PID:9624
- C:\Windows\System\wuAEjgo.exe
  C:\Windows\System\wuAEjgo.exe
  2⤵
  PID:8640
- C:\Windows\System\QqApsXJ.exe
  C:\Windows\System\QqApsXJ.exe
  2⤵
  PID:9680
- C:\Windows\System\sUyzvdl.exe
  C:\Windows\System\sUyzvdl.exe
  2⤵
  PID:9556
- C:\Windows\System\GmnNEVI.exe
  C:\Windows\System\GmnNEVI.exe
  2⤵
  PID:8920
- C:\Windows\System\GCtOFQB.exe
  C:\Windows\System\GCtOFQB.exe
  2⤵
  PID:9756
- C:\Windows\System\lxbXOPq.exe
  C:\Windows\System\lxbXOPq.exe
  2⤵
  PID:9700
- C:\Windows\System\rkfjGXz.exe
  C:\Windows\System\rkfjGXz.exe
  2⤵
  PID:9108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AnfaIzF.exe

Filesize
1.5MB

MD5
7b357e1603029bf007523635001cd750

SHA1
42e366b3a0a3a7ec90d5c699ef15d0d2b22d4296

SHA256
b886465949438e4422e534c8ee2930a29ba7e9d7b62ef887b4d16fb8627fb062

SHA512
197acf57d626849c604d7f4a563b811a5fece1a8f4fd867cfaa6b2e4ea3c76565d2531d0bdc2d788bfdee684a125fff2a38b91f7dab12626a1788f52b0a82fae

Download Submit
C:\Windows\system\ClYoLmH.exe

Filesize
1.5MB

MD5
74782862803b05e7ed5bdd803a2e9238

SHA1
71e9eb477e26d7d7e3d5f3a67d819536dc941884

SHA256
69c41022b31d8fabfcc9f1f8db6a56ae309f15c696e96dcdec4195f3ac8f20b7

SHA512
1c989273faafb66b3e9088bcdc3de619381b341f4715f3b86088371691d4d5fb7f9fdf021eea8b10700ebdf88cc1c4d3ae105726ccdaf7bf0590d03f04f4227b

Download Submit
C:\Windows\system\Effwbvo.exe

Filesize
1.5MB

MD5
378e46765473598fe6484c039aef6ad1

SHA1
28a27b4cd7f86a0eb0038e1fd64508d2ad48be7a

SHA256
06b3d7c77a0f177859cf975a1189b672e57536bc51f558fadabf00ec6c639ae9

SHA512
ec5b998acf52bcbd9978453d13155214fdd53e3b4b2ec6cc6bbb1227f6de2972c82d037aa180e76f24cf2f4a8e76bd711bfe2963e809372c9301cc812477174d

Download Submit
C:\Windows\system\LfgYIBs.exe

Filesize
1.5MB

MD5
e7be528c386c11dea8d928a9180b8903

SHA1
e8cb5deddc98570e518b6769b6e3f955e717624e

SHA256
4d7189600f7a411c3df70f4ed6b0c2ccf6ca489aaa27c74098a3d0f4173b574b

SHA512
342e41e94874d60ba4233287d5d345126338370924469710906add20d719c21aac33c0a7004255b566ae96f405e63d81586b5a489ac39e7a25f5928ef1453c71

Download Submit
C:\Windows\system\LqsjoZi.exe

Filesize
1.5MB

MD5
d525bc7887d4091a977266e8238aef19

SHA1
6b49201e16795c21a73bba989c5869e6d04dc91a

SHA256
43902cae6d89de9801cff43dfca78c65c62601e40f88660bb04aa23961b2193b

SHA512
812f0b623ca350367981270613268cfee9ff35769ca4c92130a772fdbe180a0dccb63c0b6351f1d088c24e13f392839987a774a5c5399f14808ae8cd4a1358ee

Download Submit
C:\Windows\system\NIxTXNF.exe

Filesize
1.5MB

MD5
287ea900de68fe29274d72c3260e1449

SHA1
aacaaf53e5b01e4aaf4ef5ae3b28ff87fdb4a00d

SHA256
12d2e23a2eb5e499f32654e2a9026051d26195721534fcba29cb9278d5de9f02

SHA512
0ee528abac2ca948c33c1e35d8248160f0b0f8ba442e9212aa1c2a88409efc364267d2db66ccfaa07f56a41469e3356b04807bee5ab959f53c4ddf28c01fe747

Download Submit
C:\Windows\system\NWwNDLJ.exe

Filesize
1.5MB

MD5
6b6ba9bf0642605ba8a025dcc1d50f85

SHA1
c3c2d99da672ba2e0abde9b00e1bbe102ca6e4c1

SHA256
ddf1b36cae217fe78041c9777897517d11d370f7c89ecea1e1511255f207384e

SHA512
a6af6f906c5e33d1b11f7d83ac7ab32ae2bd5f68636c731caacc747ac4d1d2c9b94a6e228fe1038e7c7c52c88ed9c1121818e36086a568ca31352fdbfdf7d2ed

Download Submit
C:\Windows\system\RuoTgNY.exe

Filesize
1.5MB

MD5
14161a87988b1467e1e954a5044203ee

SHA1
8763bec60f8b357d44e65a8c6badc515c522185c

SHA256
8f45db8d966005d2156ac3105584f68f4e20e6d9465126ceaf4120f75edb9f53

SHA512
3eb4a7a57e9cb4ab30c1827f18d8e5ab2670006cc8fc59102389c35f24a9f2f84671ead19dc052edf3948a574ef66a2f517e858c2f47c66b2ef6cbbdf10e6966

Download Submit
C:\Windows\system\TlmNTea.exe

Filesize
1.5MB

MD5
dd9f62d5958ced58260a71f98fbf1dde

SHA1
b8de2677c99cfe4742291d328c580ceeb7d9e82f

SHA256
552dd3d30e5fdbeacf77e7a8979463e31caaeae2e63f9dab0b20e8f442a01a2e

SHA512
9188cc2f4035d7d6addb4c6fc1f3fef64725a81cd34bd19b433546187ef5d82408a851b539b4b1f27805433c8f68568ba8cfb3e009b0b9142d598bffb55b3e7e

Download Submit
C:\Windows\system\VatvTiI.exe

Filesize
1.5MB

MD5
60074d865ae8bfc0d6f69b2def4d2e46

SHA1
8ae2879ec2bba0db3b90bd3a2cd05ca3e460d089

SHA256
8cf33618e2481192f38ec1e6d0ef5afdd3e89d4f06fe69a7b8828926215cb53d

SHA512
af32bf9a56ba4318c6cc60421d10c6e4c1fb3332e920339d43c3517c4b32a0eca2c1cfbf27de57b70624e33bf54b79277c5d8425a266198d74d63bc41d719b2b

Download Submit
C:\Windows\system\XMqtrph.exe

Filesize
1.5MB

MD5
e322c749a7ad778316d9aba0558acf5f

SHA1
009e04b161d705026a315b63f6e88d08709fd240

SHA256
c44c4508df7ab89571b6969aa6cfbadd9391ea80a323ed0d79924b62c6b54549

SHA512
94b90f0e8fe25bf201547857f5a6c8f81b67a63cda041f5945a71e50f9e7875ba7871619adf7990514cdbe629ee2c9a0d3d73457fdb3d323879f01f7f9c33b6b

Download Submit
C:\Windows\system\bEJpDQl.exe

Filesize
1.5MB

MD5
41966ea473b780106e4243c6a70cf508

SHA1
22bd98fe9d522fac89d6b1eba2f8bdbdc72e6083

SHA256
53041ca6c8621c700819d5dc9ffb97615c5495b548f4dd5a429c9d1c865c80f1

SHA512
697fcb7f9b10ef5254aff37acb13ff30a380138b6fdd0fdc70ab413c757a90e9d61eca24bd732b1e097ac39c9312ee8a16a028839226a7cfd98aafc4fee684c8

Download Submit
C:\Windows\system\fiyluKR.exe

Filesize
1.5MB

MD5
76054915a93798694f8a306682997d13

SHA1
74ee1dbd6f25d2be6d278c83044e09b2945a3575

SHA256
2032a2d690321c3c11d2d9bdf5617832848227402ccd1b608dfa500246566846

SHA512
146d68fcae4d97db93bde786ccbd26167fbe1083d9446b9f7a390e86d9e3456b3919f6fcfaa062bba3e5ad3530559ced8302735f92c674319264dafc4324da79

Download Submit
C:\Windows\system\fkvZFjt.exe

Filesize
1.5MB

MD5
a6a377feae8aa2a40a9cb8715faea077

SHA1
9b5971a6c6c427c6a49eeda8d480bbd9970b90ea

SHA256
e38e8b34a7c2d6a3965ba366d8d28ee123d4346e83deed5dee2bc2c92262d267

SHA512
b97211aa596bde1e237cad27cc35af985bc7914224b9b6f2d1f0ddf297f3ca3065a8659e3ba9d512159e6b095b54203d296267cc260f0b5e25efbfdb639e2bec

Download Submit
C:\Windows\system\fseGfBe.exe

Filesize
1.5MB

MD5
6f8357c6d2cc39df88d9b12be70246f9

SHA1
3e3ebb93e4458754a2d8cc07be2c3f3ca9c0a14c

SHA256
730f4d30ed8eecf21368f12939e702cbb682cc1f5806d4b06d61e4727ad5eb4e

SHA512
96579fa13afe33cd9ae9de11698e55f21f48bbb5bc4227e4967dac5361527c5f23779a88759dd0a02a4876b5615f699394eabab141c3666c02a26ddb66991d52

Download Submit
C:\Windows\system\guFpBNv.exe

Filesize
1.5MB

MD5
ae732546e3e90d9378aed454de86f423

SHA1
9b5f777c940b562678b061b9b12fbf27137de427

SHA256
5b4b6a3fe7e4f5343f0f3ecf4637a0601b97c881ffbd6f6f62f6d7cd51e39014

SHA512
965e170602ef3bece66e131e467f1b6afa93ce6ecaa248bdb9846e66091dfc319e50502dbe9c124995a3a2424639daa20a16945b632979828b988e44135e7f22

Download Submit
C:\Windows\system\hPeBSUr.exe

Filesize
1.5MB

MD5
c9ce6933493674fefd09d4630f2f2ee5

SHA1
7805707253f137b9d39fe57a9814cd35439a7005

SHA256
c60fe5334c3b1fa412f905e4f8b383a8523c7db60998d5a28a4fdca03cac98f0

SHA512
d0257fc05ba167cfbe05909fe88629dd3d1e192ea58a253f2fe3bf486328ffac97d0030267f46cb3f6b0878ae9f23004b641374ac3162c9403f45b266aef9385

Download Submit
C:\Windows\system\iHMtTLL.exe

Filesize
1.5MB

MD5
43f79c37e0299a04dce90168516199d4

SHA1
06a6b5a3cfbcf07020d6304b75a98239ba4ea26a

SHA256
a8c462e7020c1646066ee6886657ea6e506ce474a691754af4b602ec5ccc6461

SHA512
f7c0d3d6e8fe00d7c8cdbd83bfa5e83a82da1f1bd4a708a4f4e98e6d0c7c96747bf95f3db376dd681263013601f4c81cbc2a075d7fe9477db9581459c2758062

Download Submit
C:\Windows\system\ildnhYD.exe

Filesize
1.5MB

MD5
4dc2c3f083e20bca74de4da09f418399

SHA1
0b022e221e3e11fc49f1c2e4ac85a105a8924363

SHA256
2a52ebc72547be53e1c330acbf4652e99f1411f5894391bec8942c795e305e9e

SHA512
e5a538f2ea8bd265c8e63f266b8cacc6862c4e2431b556fa312f32dd57cee36a606dc23dae53b3b8ea04e503a6b04a4c93ae736a6c2fa81f55e2cee74727a0f2

Download Submit
C:\Windows\system\jorHlub.exe

Filesize
1.5MB

MD5
9986c35f701abc9b6ec57aafe434ae6f

SHA1
71812d4e02d192bda6976f8410db2dd50bbf028c

SHA256
b0429024e6365d4fad8f2802fcbcced00c4d25b71af4d4ac10333a0e3d8383dc

SHA512
cb14de4dd3d7ca3a06725a01d414f18a8f66a3ababa201fc384bbffff2ef85adeb49058ebd73bdc8ee3a7d907cd605dce353c4d52964472c66d4c5aca22e0418

Download Submit
C:\Windows\system\lkuyNpd.exe

Filesize
1.5MB

MD5
1aab95aa65c68dcb41f06376ff8c835f

SHA1
a9b3113b3fe401cd0a153054f3ef99a6922aa3be

SHA256
50ebf9dae2afaf03fff38fa24591c809aa02affeb2559ba0e9bae34ab6a4fd6e

SHA512
96d97907e2ddc1354e59277afe29afdf3499616e0dce4eefbb636e149b5da02b8a9f3ea7103d33ca74d22c1fedfac2e16d9f3f15cfef761cd8642a08548ba7c2

Download Submit
C:\Windows\system\oMclQrY.exe

Filesize
1.5MB

MD5
50e810bde26e8ebf7f5e9137337330aa

SHA1
37175cd90db3e2e0d6fb03f10fe67842c72a9fe5

SHA256
8a6f16082c91045f599af263625b9b3805c9c5c4347b39cd9551fa973b3988fc

SHA512
b041856c690bda883b0607009c1ac3c086d800ab19a01ade6a27c76e7d4c6a300df0493b0d5f8c51e1605d9b02a78eb56479279f87d7670ef364d345c6b3abcc

Download Submit
C:\Windows\system\pyEolAs.exe

Filesize
1.5MB

MD5
3b1ac85faceae7f6d54581e4d234502c

SHA1
e7e710381a246ebd2749c6b9957ed94970a80aa3

SHA256
432c1df0f3d54c8ce7b226cc8ed722c3519de1b325bcf32a822afb47aa8350e9

SHA512
e8f0b31a6049a00222741635fcc4004ce8d02d1a33193ab69b52db45d438e7e4003368ecd83706bc2ffa1a0cd23c323d8caf6cb6a63859eb5df1a7ff161cec14

Download Submit
C:\Windows\system\zdGFthS.exe

Filesize
1.5MB

MD5
ab3128c54c8e3112ef3667c581060d31

SHA1
803f2ff1b584424fbaa1abb4946c9c6f29b66211

SHA256
b2661436740bc23484186003e699655a320af5b1a7e08a793cab74c6e8f8fc87

SHA512
df3015e38de31ab60a455b3047f09b49fae76e92b2d5cdf39e373cf0ad59c1ce41b292cf716319350a64c872552e09537355dfac029c629d7f6546d466ab9534

Download Submit
\Windows\system\BGKPIEB.exe

Filesize
1.5MB

MD5
77e609a6d06a9c392d300bdfe5794266

SHA1
34f99fe5db2979201af5aba896befc0e3b6a4383

SHA256
e4a2529db66413d8debe9eedcec990baffef1f8236a22480d5c5fda9dbf20891

SHA512
981275daecacf464d032efa9d77efdff474f7d2946f77028d8e9cc372100a760619eab28cc55210cbed93001e9c4ec7a029d71eacacfde6fbe85e368cdbd6d98

Download Submit
\Windows\system\CEndIBq.exe

Filesize
1.5MB

MD5
a7b197d8c60beb191626c72420a7fae5

SHA1
8e18210014e1dd31b25765d41cbd7be06982c60b

SHA256
40537887c9ff1afc62e06407fd74a23f577b342e9b44d1f2ceb3cb485659bc81

SHA512
85b87357539d8e457cfb38e80991d626e704d85acb61b68028ae5b81d1b4dd5ac97321d56106b57b37328adb8c77454f07c2f95666d63fc6ea61213069e891b9

Download Submit
\Windows\system\JXaakuk.exe

Filesize
1.5MB

MD5
b776f72103d3718be2a389a670b05fb8

SHA1
9ff784fc01334f67f98f9e93a69fc7c63daa3486

SHA256
d3cb1d7ec5903a77d9b6a2259b9bee87eae33d965bc4738f4e6714f45261a7ed

SHA512
c8b46c5aee66729b5686caeae938ccd4b5a97b881d926ed7261086404e9dfcb8b33426317a4cd15c77072e766d7d8e546e73342b6b706e1dc8ef9d5f7b10c557

Download Submit
\Windows\system\KvjvtZc.exe

Filesize
1.5MB

MD5
f374d291f8487e3ee522e58a38fb3b3c

SHA1
b437ef4df22890693efa7b2948864b7e3c1d8a3c

SHA256
1215b014fae2ce7e5cb6495471fbcb43bd7602c1794279435f512df507170f67

SHA512
4ed577267eca04488d30f9e788cb4d5a7d4dcc8c32f3f5344beb54086a4f508b0309d9d11c82bb17c790d76689492bef635b5a3d1bbd58136fe5cf07d6d68837

Download Submit
\Windows\system\LOMxyur.exe

Filesize
1.5MB

MD5
e5f581560e69055488a19f08c5470a8f

SHA1
8aed0ce6e3e18ffc41094e507b46d72a8092cbf5

SHA256
515e808f0d2065b4cfd0774f60b9317056dab875c04e0ffec5cfe1af4d2e98bf

SHA512
8cf0e0d8caec9ef4cc0ee81c6f3c85a898f7acf85845d7daac37bef6c603ccf8b583f051cd8e53f8ac77ce340d7b7e74fad243b144196bd6258d7975bfcec9b0

Download Submit
\Windows\system\bqJcaXs.exe

Filesize
1.5MB

MD5
8da3c8432d91c548c496651780eed436

SHA1
06c263339816e1b3be003716342987d926db43a0

SHA256
d456182e6eab8a181378f83db4a797bb1f07fd96deccd1f7d270bfc0d46d17ee

SHA512
a63e082142fc78cf80067ccfb901f70108b20ffd7747914a2dc71e6ef28d03a3d966e818b8e472bba707c49bec3d8709dac5e422f9d9ca8213c79d1002cf509a

Download Submit
\Windows\system\fpyoBTb.exe

Filesize
1.5MB

MD5
f2883c4c37781d21b21f2f6eb4d6a432

SHA1
19c0bad370cdef7ab69f69cd34f95f9c2f44f30c

SHA256
d6e7d76f474a7bbbe7268742de1c71d85ac5c66bb34935c5cd19c322f59396cc

SHA512
b58b2b7cb64219686086fff9451e75b24a8fbc3ad79a4f2182590e8753cc7bcbe99bc69a1b9b07fce0fbf637f00935cf8366253f0ef143ea07021ea345916118

Download Submit
\Windows\system\oQaoUAZ.exe

Filesize
1.5MB

MD5
b10a1046da62e85f54383e503953e054

SHA1
8851b6312fe375e52403789bbc0fe2688f667b69

SHA256
6246221a61e740f9ee297ef83fd6223c9aee8aff102897f2a6c893e1d4936744

SHA512
625d58bc1096dd8d692bffedeed42029b349f5cc1e6e1f70739e343ba441f537a727da2c6eefe55f8467977888426a3c75a6612dfa0fff2b731430b5128e8374

Download Submit
memory/392-2723-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/392-122-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2124-128-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2124-1763-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2196-1766-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2196-108-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2248-81-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2248-111-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2248-144-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2248-43-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/2248-42-0x000000001B1E0000-0x000000001B4C2000-memory.dmp

Filesize
2.9MB

Download
memory/2248-82-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2248-17-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/2248-83-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2376-127-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2376-2795-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2396-1782-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2396-110-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2404-100-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-1764-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-2783-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-114-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-1761-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2504-92-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2668-1765-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2668-90-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2676-105-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-1759-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-2724-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2836-120-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2936-102-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-112-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-125-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2936-131-0x0000000002B70000-0x0000000002F62000-memory.dmp

Filesize
3.9MB

Download
memory/2936-95-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-1-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2936-107-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2936-88-0x0000000002B70000-0x0000000002F62000-memory.dmp

Filesize
3.9MB

Download
memory/2936-117-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2936-109-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2936-115-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2936-121-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2936-16-0x0000000002B70000-0x0000000002F62000-memory.dmp

Filesize
3.9MB

Download
memory/2936-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/3032-2789-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/3032-124-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download