xmrig | 909a3987a29267613b5a96530485723fb4ec7ff981e71a96b1fe2c1b6e8aea4c

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
Size

1.6MB
MD5

b690185077d04c38e4fa85ddcfdc5666
SHA1

7f785ac5502bfe6c103504e165d1c3ef4e92bf8d
SHA256

909a3987a29267613b5a96530485723fb4ec7ff981e71a96b1fe2c1b6e8aea4c
SHA512

5a34b4c655825556956592981d41b7eed7326dbcca7245de145b8c7905f5472d23dd9a6cbe416b3bebc56b4d567a8111d4beea68569a07f641e1070f8b072151
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82Sz66E:NABf

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral1/memory/2764-9-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/3044-25-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2912-79-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2628-81-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2684-82-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2900-250-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2800-291-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/3044-313-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/1228-472-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2232-93-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/1228-90-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/1784-87-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2440-86-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/1044-100-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2800-98-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2440-2242-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2900-2305-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/1044-3357-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/3044-3361-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/1784-3371-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2232-3442-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2764-3444-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/1228-3443-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2628-3448-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2684-3812-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2912-3786-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2756	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2764	IoAOvOi.exe
2900	jvrNMjP.exe
3044	FxzzlJi.exe
2912	LQeMfXV.exe
2628	jQgUdty.exe
2684	YhFTyFp.exe
2440	cScVuKf.exe
2232	jPUEBwL.exe
1784	BKsaRNn.exe
1228	aJaLAro.exe
1044	efDYeDw.exe
2308	tHgCmgn.exe
1532	UPBoStZ.exe
3068	NgVSwYG.exe
2864	zlrnNdV.exe
2336	WSATlHr.exe
2472	buOCEbB.exe
1912	eGGjgbB.exe
2948	iUGxDJk.exe
1972	ScsePMh.exe
760	GLFmdZG.exe
528	wqpvikl.exe
1940	BAgFuJo.exe
2160	iUpehJG.exe
2184	nnMlFoU.exe
2832	khrfgJX.exe
1780	NMbMcGc.exe
2188	GeqsOfd.exe
884	CueKmSC.exe
2076	CKrGLcQ.exe
1548	tvSArut.exe
1792	lBtGhFt.exe
820	uAYuMAE.exe
1352	mCqTjCo.exe
1744	sIaqDsV.exe
1772	EBCYYQY.exe
1688	vSEQaex.exe
592	MhUKzJU.exe
1536	iTyrcXB.exe
2252	qMhrKTV.exe
2576	wRwrGZF.exe
2984	rSkYhRZ.exe
1540	ydSRxEe.exe
2236	jKryliw.exe
2280	blWcjrk.exe
812	iUSsxmS.exe
304	OwbfNtM.exe
236	hUINnPm.exe
1500	uygSnfO.exe
2092	xdQumqt.exe
1596	qEhfJlR.exe
2744	qzInDbH.exe
2816	couSliq.exe
3000	iUGuHUE.exe
2868	fkaNrlH.exe
2856	VTGPJiq.exe
2908	NiKdqPI.exe
1348	XVeIuVK.exe
2460	KkGmqSB.exe
2940	DcGiZgD.exe
572	fzwbWYr.exe
2896	MKKRPij.exe
2704	BTaywpi.exe
2612	IVzZBSm.exe

Loads dropped DLL 64 IoCs

pid	Process
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2800-0-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/files/0x0004000000017801-3.dat	upx
behavioral1/memory/2764-9-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/files/0x0008000000018f98-10.dat	upx
behavioral1/memory/2900-14-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x0007000000018f9c-16.dat	upx
behavioral1/memory/3044-25-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/files/0x0006000000018fa0-28.dat	upx
behavioral1/files/0x0007000000018fac-55.dat	upx
behavioral1/files/0x000500000001a2a1-63.dat	upx
behavioral1/files/0x000500000001a2a3-66.dat	upx
behavioral1/memory/2912-79-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2628-81-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2684-82-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x000500000001a29f-71.dat	upx
behavioral1/files/0x000500000001a298-62.dat	upx
behavioral1/files/0x000500000001a2b7-94.dat	upx
behavioral1/files/0x0007000000018fa6-54.dat	upx
behavioral1/files/0x000500000001a2ac-102.dat	upx
behavioral1/files/0x000500000001a2be-111.dat	upx
behavioral1/files/0x000500000001a2eb-128.dat	upx
behavioral1/files/0x000500000001a2f4-141.dat	upx
behavioral1/files/0x000500000001a2fc-147.dat	upx
behavioral1/files/0x000500000001a305-153.dat	upx
behavioral1/files/0x000500000001a320-166.dat	upx
behavioral1/files/0x000500000001a324-171.dat	upx
behavioral1/files/0x000500000001a334-181.dat	upx
behavioral1/files/0x000500000001a338-187.dat	upx
behavioral1/memory/2900-250-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2800-291-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/files/0x000500000001a32f-176.dat	upx
behavioral1/memory/3044-313-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/files/0x000500000001a30b-160.dat	upx
behavioral1/files/0x000500000001a300-151.dat	upx
behavioral1/files/0x000500000001a2ef-136.dat	upx
behavioral1/files/0x000500000001a2dd-126.dat	upx
behavioral1/files/0x000500000001a2c7-116.dat	upx
behavioral1/files/0x000500000001a2ce-120.dat	upx
behavioral1/files/0x000500000001a2ba-106.dat	upx
behavioral1/memory/1228-472-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2232-93-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/1228-90-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/1784-87-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2440-86-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/1044-100-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2800-98-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/files/0x0009000000018faa-52.dat	upx
behavioral1/files/0x001000000000558f-32.dat	upx
behavioral1/files/0x002b000000018f8e-39.dat	upx
behavioral1/memory/2440-2242-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2900-2305-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/1044-3357-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/3044-3361-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/1784-3371-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2232-3442-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2764-3444-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/1228-3443-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2628-3448-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2684-3812-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2912-3786-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VQtxpkn.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\VNOIbQv.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\XfJauKS.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\ewTaQye.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\vdHtnkt.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\guWIMqs.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\hsHpQJc.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\znGxfnf.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\bavXMla.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\UQubduN.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\qDNRZmr.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\TZdFukX.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\WMXMvYS.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\KMnSqNV.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\SxBckbN.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\rvxddkx.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\rateqvC.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\ztxhmQV.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\BTaywpi.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\VHzTtZK.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\HnnAVYA.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\kQVaGwU.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\WwscKLE.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\lipzZzz.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\mFGHLQZ.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\tfVSGMi.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\oxaOXYu.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\uJgxWlc.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\pNUHKJj.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\XkHjJVK.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\UzbAlel.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\GvmnieA.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\gthhXCq.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\cGubjdB.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\yEPBeJO.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\rjZDflN.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\mCRxUiO.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\ozyZsyg.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\opmEkfp.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\lmYYVla.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\jlfKUeM.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\mOWBwcA.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\LduZlCt.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\GBpFdjs.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\gJrOBkm.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\swvugMX.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\hlEgxPb.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\MRSRIxJ.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\XVeIuVK.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\QzjtaVT.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\AqliRVe.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\VKfyYQF.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\VjXgapU.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\LpVSbrT.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\UkUTKAo.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\MWBVihr.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\PEvWkjv.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\GWTNOMw.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\WphhLOd.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\dmEEKNs.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\dzuegWm.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\SHIbdcj.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\wcWUdtf.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
File created	C:\Windows\System\JXaayll.exe	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2756	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
Token: SeDebugPrivilege	2756	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2756	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	31
PID 2800 wrote to memory of 2756	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	31
PID 2800 wrote to memory of 2756	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	31
PID 2800 wrote to memory of 2764	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	32
PID 2800 wrote to memory of 2764	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	32
PID 2800 wrote to memory of 2764	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	32
PID 2800 wrote to memory of 2900	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	33
PID 2800 wrote to memory of 2900	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	33
PID 2800 wrote to memory of 2900	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	33
PID 2800 wrote to memory of 3044	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	34
PID 2800 wrote to memory of 3044	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	34
PID 2800 wrote to memory of 3044	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	34
PID 2800 wrote to memory of 2912	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	35
PID 2800 wrote to memory of 2912	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	35
PID 2800 wrote to memory of 2912	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	35
PID 2800 wrote to memory of 2628	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	36
PID 2800 wrote to memory of 2628	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	36
PID 2800 wrote to memory of 2628	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	36
PID 2800 wrote to memory of 2684	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	37
PID 2800 wrote to memory of 2684	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	37
PID 2800 wrote to memory of 2684	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	37
PID 2800 wrote to memory of 2232	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	38
PID 2800 wrote to memory of 2232	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	38
PID 2800 wrote to memory of 2232	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	38
PID 2800 wrote to memory of 2440	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	39
PID 2800 wrote to memory of 2440	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	39
PID 2800 wrote to memory of 2440	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	39
PID 2800 wrote to memory of 1784	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	40
PID 2800 wrote to memory of 1784	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	40
PID 2800 wrote to memory of 1784	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	40
PID 2800 wrote to memory of 1228	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	41
PID 2800 wrote to memory of 1228	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	41
PID 2800 wrote to memory of 1228	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	41
PID 2800 wrote to memory of 1044	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	42
PID 2800 wrote to memory of 1044	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	42
PID 2800 wrote to memory of 1044	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	42
PID 2800 wrote to memory of 1532	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	43
PID 2800 wrote to memory of 1532	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	43
PID 2800 wrote to memory of 1532	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	43
PID 2800 wrote to memory of 2308	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	44
PID 2800 wrote to memory of 2308	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	44
PID 2800 wrote to memory of 2308	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	44
PID 2800 wrote to memory of 2864	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	45
PID 2800 wrote to memory of 2864	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	45
PID 2800 wrote to memory of 2864	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	45
PID 2800 wrote to memory of 3068	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	46
PID 2800 wrote to memory of 3068	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	46
PID 2800 wrote to memory of 3068	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	46
PID 2800 wrote to memory of 2336	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	47
PID 2800 wrote to memory of 2336	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	47
PID 2800 wrote to memory of 2336	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	47
PID 2800 wrote to memory of 2472	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	48
PID 2800 wrote to memory of 2472	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	48
PID 2800 wrote to memory of 2472	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	48
PID 2800 wrote to memory of 1912	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	49
PID 2800 wrote to memory of 1912	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	49
PID 2800 wrote to memory of 1912	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	49
PID 2800 wrote to memory of 2948	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	50
PID 2800 wrote to memory of 2948	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	50
PID 2800 wrote to memory of 2948	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	50
PID 2800 wrote to memory of 1972	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	51
PID 2800 wrote to memory of 1972	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	51
PID 2800 wrote to memory of 1972	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	51
PID 2800 wrote to memory of 760	2800	b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b690185077d04c38e4fa85ddcfdc5666_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\System\IoAOvOi.exe
  C:\Windows\System\IoAOvOi.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\jvrNMjP.exe
  C:\Windows\System\jvrNMjP.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\FxzzlJi.exe
  C:\Windows\System\FxzzlJi.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\LQeMfXV.exe
  C:\Windows\System\LQeMfXV.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\jQgUdty.exe
  C:\Windows\System\jQgUdty.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\YhFTyFp.exe
  C:\Windows\System\YhFTyFp.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\jPUEBwL.exe
  C:\Windows\System\jPUEBwL.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\cScVuKf.exe
  C:\Windows\System\cScVuKf.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\BKsaRNn.exe
  C:\Windows\System\BKsaRNn.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\aJaLAro.exe
  C:\Windows\System\aJaLAro.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\efDYeDw.exe
  C:\Windows\System\efDYeDw.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\UPBoStZ.exe
  C:\Windows\System\UPBoStZ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\tHgCmgn.exe
  C:\Windows\System\tHgCmgn.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\zlrnNdV.exe
  C:\Windows\System\zlrnNdV.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\NgVSwYG.exe
  C:\Windows\System\NgVSwYG.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\WSATlHr.exe
  C:\Windows\System\WSATlHr.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\buOCEbB.exe
  C:\Windows\System\buOCEbB.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\eGGjgbB.exe
  C:\Windows\System\eGGjgbB.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\iUGxDJk.exe
  C:\Windows\System\iUGxDJk.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\ScsePMh.exe
  C:\Windows\System\ScsePMh.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\GLFmdZG.exe
  C:\Windows\System\GLFmdZG.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\wqpvikl.exe
  C:\Windows\System\wqpvikl.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\BAgFuJo.exe
  C:\Windows\System\BAgFuJo.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\iUpehJG.exe
  C:\Windows\System\iUpehJG.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\nnMlFoU.exe
  C:\Windows\System\nnMlFoU.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\khrfgJX.exe
  C:\Windows\System\khrfgJX.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\NMbMcGc.exe
  C:\Windows\System\NMbMcGc.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\GeqsOfd.exe
  C:\Windows\System\GeqsOfd.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\CueKmSC.exe
  C:\Windows\System\CueKmSC.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\CKrGLcQ.exe
  C:\Windows\System\CKrGLcQ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\tvSArut.exe
  C:\Windows\System\tvSArut.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\lBtGhFt.exe
  C:\Windows\System\lBtGhFt.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\uAYuMAE.exe
  C:\Windows\System\uAYuMAE.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\sIaqDsV.exe
  C:\Windows\System\sIaqDsV.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\mCqTjCo.exe
  C:\Windows\System\mCqTjCo.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\EBCYYQY.exe
  C:\Windows\System\EBCYYQY.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\vSEQaex.exe
  C:\Windows\System\vSEQaex.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\MhUKzJU.exe
  C:\Windows\System\MhUKzJU.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\iTyrcXB.exe
  C:\Windows\System\iTyrcXB.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\wRwrGZF.exe
  C:\Windows\System\wRwrGZF.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\qMhrKTV.exe
  C:\Windows\System\qMhrKTV.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\rSkYhRZ.exe
  C:\Windows\System\rSkYhRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\ydSRxEe.exe
  C:\Windows\System\ydSRxEe.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\jKryliw.exe
  C:\Windows\System\jKryliw.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\blWcjrk.exe
  C:\Windows\System\blWcjrk.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\iUSsxmS.exe
  C:\Windows\System\iUSsxmS.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\OwbfNtM.exe
  C:\Windows\System\OwbfNtM.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\uygSnfO.exe
  C:\Windows\System\uygSnfO.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\hUINnPm.exe
  C:\Windows\System\hUINnPm.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\xdQumqt.exe
  C:\Windows\System\xdQumqt.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\qEhfJlR.exe
  C:\Windows\System\qEhfJlR.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\qzInDbH.exe
  C:\Windows\System\qzInDbH.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\couSliq.exe
  C:\Windows\System\couSliq.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\BTaywpi.exe
  C:\Windows\System\BTaywpi.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\iUGuHUE.exe
  C:\Windows\System\iUGuHUE.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\IVzZBSm.exe
  C:\Windows\System\IVzZBSm.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\fkaNrlH.exe
  C:\Windows\System\fkaNrlH.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\atZGzNI.exe
  C:\Windows\System\atZGzNI.exe
  2⤵
  PID:1816
- C:\Windows\System\VTGPJiq.exe
  C:\Windows\System\VTGPJiq.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\FMuJSOl.exe
  C:\Windows\System\FMuJSOl.exe
  2⤵
  PID:1952
- C:\Windows\System\NiKdqPI.exe
  C:\Windows\System\NiKdqPI.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\eeVhNOn.exe
  C:\Windows\System\eeVhNOn.exe
  2⤵
  PID:3024
- C:\Windows\System\XVeIuVK.exe
  C:\Windows\System\XVeIuVK.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\mhrdplY.exe
  C:\Windows\System\mhrdplY.exe
  2⤵
  PID:2164
- C:\Windows\System\KkGmqSB.exe
  C:\Windows\System\KkGmqSB.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\qynMVTj.exe
  C:\Windows\System\qynMVTj.exe
  2⤵
  PID:2796
- C:\Windows\System\DcGiZgD.exe
  C:\Windows\System\DcGiZgD.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\tLtUWRR.exe
  C:\Windows\System\tLtUWRR.exe
  2⤵
  PID:2448
- C:\Windows\System\fzwbWYr.exe
  C:\Windows\System\fzwbWYr.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\HBxGsNg.exe
  C:\Windows\System\HBxGsNg.exe
  2⤵
  PID:2404
- C:\Windows\System\MKKRPij.exe
  C:\Windows\System\MKKRPij.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\rzzzzAN.exe
  C:\Windows\System\rzzzzAN.exe
  2⤵
  PID:1752
- C:\Windows\System\ucZMZDZ.exe
  C:\Windows\System\ucZMZDZ.exe
  2⤵
  PID:2792
- C:\Windows\System\eNUOCJi.exe
  C:\Windows\System\eNUOCJi.exe
  2⤵
  PID:616
- C:\Windows\System\pCJQTKG.exe
  C:\Windows\System\pCJQTKG.exe
  2⤵
  PID:752
- C:\Windows\System\tRzfpyf.exe
  C:\Windows\System\tRzfpyf.exe
  2⤵
  PID:912
- C:\Windows\System\BQJeDHN.exe
  C:\Windows\System\BQJeDHN.exe
  2⤵
  PID:1248
- C:\Windows\System\wddyviq.exe
  C:\Windows\System\wddyviq.exe
  2⤵
  PID:2000
- C:\Windows\System\PHBWIuO.exe
  C:\Windows\System\PHBWIuO.exe
  2⤵
  PID:2356
- C:\Windows\System\AMHQmqJ.exe
  C:\Windows\System\AMHQmqJ.exe
  2⤵
  PID:2408
- C:\Windows\System\IkrrRJa.exe
  C:\Windows\System\IkrrRJa.exe
  2⤵
  PID:2972
- C:\Windows\System\onwEdJy.exe
  C:\Windows\System\onwEdJy.exe
  2⤵
  PID:1644
- C:\Windows\System\FrWbFZE.exe
  C:\Windows\System\FrWbFZE.exe
  2⤵
  PID:1684
- C:\Windows\System\qihFeVp.exe
  C:\Windows\System\qihFeVp.exe
  2⤵
  PID:1412
- C:\Windows\System\TbieBWL.exe
  C:\Windows\System\TbieBWL.exe
  2⤵
  PID:1584
- C:\Windows\System\PnsnqKm.exe
  C:\Windows\System\PnsnqKm.exe
  2⤵
  PID:2632
- C:\Windows\System\zOTgnZT.exe
  C:\Windows\System\zOTgnZT.exe
  2⤵
  PID:2768
- C:\Windows\System\vqOdXZx.exe
  C:\Windows\System\vqOdXZx.exe
  2⤵
  PID:1492
- C:\Windows\System\ZwzcwFR.exe
  C:\Windows\System\ZwzcwFR.exe
  2⤵
  PID:2224
- C:\Windows\System\ohMZwOs.exe
  C:\Windows\System\ohMZwOs.exe
  2⤵
  PID:1932
- C:\Windows\System\WVMuiRJ.exe
  C:\Windows\System\WVMuiRJ.exe
  2⤵
  PID:1720
- C:\Windows\System\DPFAkjX.exe
  C:\Windows\System\DPFAkjX.exe
  2⤵
  PID:1696
- C:\Windows\System\fBeLUfp.exe
  C:\Windows\System\fBeLUfp.exe
  2⤵
  PID:1452
- C:\Windows\System\UBKffHk.exe
  C:\Windows\System\UBKffHk.exe
  2⤵
  PID:2228
- C:\Windows\System\AoVkeBE.exe
  C:\Windows\System\AoVkeBE.exe
  2⤵
  PID:2752
- C:\Windows\System\YolXZKK.exe
  C:\Windows\System\YolXZKK.exe
  2⤵
  PID:2204
- C:\Windows\System\hFkyZSS.exe
  C:\Windows\System\hFkyZSS.exe
  2⤵
  PID:2384
- C:\Windows\System\ilwCOjp.exe
  C:\Windows\System\ilwCOjp.exe
  2⤵
  PID:2388
- C:\Windows\System\OTIuutJ.exe
  C:\Windows\System\OTIuutJ.exe
  2⤵
  PID:1740
- C:\Windows\System\olHAJij.exe
  C:\Windows\System\olHAJij.exe
  2⤵
  PID:324
- C:\Windows\System\vpEOkvM.exe
  C:\Windows\System\vpEOkvM.exe
  2⤵
  PID:1008
- C:\Windows\System\sqxZbfW.exe
  C:\Windows\System\sqxZbfW.exe
  2⤵
  PID:824
- C:\Windows\System\uhvWZZF.exe
  C:\Windows\System\uhvWZZF.exe
  2⤵
  PID:1604
- C:\Windows\System\tHFpyGT.exe
  C:\Windows\System\tHFpyGT.exe
  2⤵
  PID:2528
- C:\Windows\System\aCOxKZY.exe
  C:\Windows\System\aCOxKZY.exe
  2⤵
  PID:1504
- C:\Windows\System\fSedofZ.exe
  C:\Windows\System\fSedofZ.exe
  2⤵
  PID:3060
- C:\Windows\System\cGwnvEi.exe
  C:\Windows\System\cGwnvEi.exe
  2⤵
  PID:3032
- C:\Windows\System\YjZOgyz.exe
  C:\Windows\System\YjZOgyz.exe
  2⤵
  PID:2708
- C:\Windows\System\wEaYrci.exe
  C:\Windows\System\wEaYrci.exe
  2⤵
  PID:2524
- C:\Windows\System\vHcFWbY.exe
  C:\Windows\System\vHcFWbY.exe
  2⤵
  PID:2828
- C:\Windows\System\VgwPjFL.exe
  C:\Windows\System\VgwPjFL.exe
  2⤵
  PID:2824
- C:\Windows\System\zMcKJPR.exe
  C:\Windows\System\zMcKJPR.exe
  2⤵
  PID:2168
- C:\Windows\System\gPTqOTJ.exe
  C:\Windows\System\gPTqOTJ.exe
  2⤵
  PID:2468
- C:\Windows\System\VXIrSrx.exe
  C:\Windows\System\VXIrSrx.exe
  2⤵
  PID:2240
- C:\Windows\System\nxnlWIV.exe
  C:\Windows\System\nxnlWIV.exe
  2⤵
  PID:2644
- C:\Windows\System\aeHdgWK.exe
  C:\Windows\System\aeHdgWK.exe
  2⤵
  PID:1480
- C:\Windows\System\VEMoakU.exe
  C:\Windows\System\VEMoakU.exe
  2⤵
  PID:2424
- C:\Windows\System\hSrlKJq.exe
  C:\Windows\System\hSrlKJq.exe
  2⤵
  PID:792
- C:\Windows\System\HJIOAck.exe
  C:\Windows\System\HJIOAck.exe
  2⤵
  PID:2196
- C:\Windows\System\XJSVJNc.exe
  C:\Windows\System\XJSVJNc.exe
  2⤵
  PID:828
- C:\Windows\System\gbUKyWt.exe
  C:\Windows\System\gbUKyWt.exe
  2⤵
  PID:568
- C:\Windows\System\aEjucfi.exe
  C:\Windows\System\aEjucfi.exe
  2⤵
  PID:1976
- C:\Windows\System\uQZPQmo.exe
  C:\Windows\System\uQZPQmo.exe
  2⤵
  PID:2804
- C:\Windows\System\GroPklb.exe
  C:\Windows\System\GroPklb.exe
  2⤵
  PID:1556
- C:\Windows\System\ADMmbub.exe
  C:\Windows\System\ADMmbub.exe
  2⤵
  PID:2480
- C:\Windows\System\DUMTWxQ.exe
  C:\Windows\System\DUMTWxQ.exe
  2⤵
  PID:2256
- C:\Windows\System\WHnUyur.exe
  C:\Windows\System\WHnUyur.exe
  2⤵
  PID:2260
- C:\Windows\System\FTsYDqf.exe
  C:\Windows\System\FTsYDqf.exe
  2⤵
  PID:2056
- C:\Windows\System\GPUpdix.exe
  C:\Windows\System\GPUpdix.exe
  2⤵
  PID:856
- C:\Windows\System\uIXNkcf.exe
  C:\Windows\System\uIXNkcf.exe
  2⤵
  PID:2700
- C:\Windows\System\ayTuiar.exe
  C:\Windows\System\ayTuiar.exe
  2⤵
  PID:1964
- C:\Windows\System\BnYjBxW.exe
  C:\Windows\System\BnYjBxW.exe
  2⤵
  PID:2988
- C:\Windows\System\TqwURGr.exe
  C:\Windows\System\TqwURGr.exe
  2⤵
  PID:1796
- C:\Windows\System\wHfAChI.exe
  C:\Windows\System\wHfAChI.exe
  2⤵
  PID:2840
- C:\Windows\System\njDdsjc.exe
  C:\Windows\System\njDdsjc.exe
  2⤵
  PID:1076
- C:\Windows\System\ybGafrD.exe
  C:\Windows\System\ybGafrD.exe
  2⤵
  PID:1316
- C:\Windows\System\WgqMRdc.exe
  C:\Windows\System\WgqMRdc.exe
  2⤵
  PID:2180
- C:\Windows\System\fBPNPws.exe
  C:\Windows\System\fBPNPws.exe
  2⤵
  PID:2316
- C:\Windows\System\oTspWTY.exe
  C:\Windows\System\oTspWTY.exe
  2⤵
  PID:2556
- C:\Windows\System\wwscUyH.exe
  C:\Windows\System\wwscUyH.exe
  2⤵
  PID:2660
- C:\Windows\System\EtXuXPK.exe
  C:\Windows\System\EtXuXPK.exe
  2⤵
  PID:1056
- C:\Windows\System\cPLAsOQ.exe
  C:\Windows\System\cPLAsOQ.exe
  2⤵
  PID:1652
- C:\Windows\System\UvnxdPw.exe
  C:\Windows\System\UvnxdPw.exe
  2⤵
  PID:2208
- C:\Windows\System\NJTNgnC.exe
  C:\Windows\System\NJTNgnC.exe
  2⤵
  PID:1148
- C:\Windows\System\YMYaHjE.exe
  C:\Windows\System\YMYaHjE.exe
  2⤵
  PID:1472
- C:\Windows\System\xjfVUti.exe
  C:\Windows\System\xjfVUti.exe
  2⤵
  PID:332
- C:\Windows\System\gNktljv.exe
  C:\Windows\System\gNktljv.exe
  2⤵
  PID:3020
- C:\Windows\System\IKdvhWG.exe
  C:\Windows\System\IKdvhWG.exe
  2⤵
  PID:1856
- C:\Windows\System\APczAdj.exe
  C:\Windows\System\APczAdj.exe
  2⤵
  PID:1620
- C:\Windows\System\YSaFuQA.exe
  C:\Windows\System\YSaFuQA.exe
  2⤵
  PID:1080
- C:\Windows\System\DFZhoRr.exe
  C:\Windows\System\DFZhoRr.exe
  2⤵
  PID:2084
- C:\Windows\System\UogFjLr.exe
  C:\Windows\System\UogFjLr.exe
  2⤵
  PID:924
- C:\Windows\System\taQqvWc.exe
  C:\Windows\System\taQqvWc.exe
  2⤵
  PID:2152
- C:\Windows\System\DgrGydL.exe
  C:\Windows\System\DgrGydL.exe
  2⤵
  PID:2008
- C:\Windows\System\sFzVbFg.exe
  C:\Windows\System\sFzVbFg.exe
  2⤵
  PID:2080
- C:\Windows\System\zQDDCVB.exe
  C:\Windows\System\zQDDCVB.exe
  2⤵
  PID:1164
- C:\Windows\System\xLmIEJq.exe
  C:\Windows\System\xLmIEJq.exe
  2⤵
  PID:1212
- C:\Windows\System\ceLXcPN.exe
  C:\Windows\System\ceLXcPN.exe
  2⤵
  PID:1520
- C:\Windows\System\gefkQww.exe
  C:\Windows\System\gefkQww.exe
  2⤵
  PID:2120
- C:\Windows\System\eyyQzkf.exe
  C:\Windows\System\eyyQzkf.exe
  2⤵
  PID:2904
- C:\Windows\System\uxSoTIF.exe
  C:\Windows\System\uxSoTIF.exe
  2⤵
  PID:1916
- C:\Windows\System\LNfXMvs.exe
  C:\Windows\System\LNfXMvs.exe
  2⤵
  PID:548
- C:\Windows\System\fLImOll.exe
  C:\Windows\System\fLImOll.exe
  2⤵
  PID:3028
- C:\Windows\System\peXaKVv.exe
  C:\Windows\System\peXaKVv.exe
  2⤵
  PID:2976
- C:\Windows\System\PbVxENJ.exe
  C:\Windows\System\PbVxENJ.exe
  2⤵
  PID:2364
- C:\Windows\System\XkJmPNU.exe
  C:\Windows\System\XkJmPNU.exe
  2⤵
  PID:1960
- C:\Windows\System\thwSjyC.exe
  C:\Windows\System\thwSjyC.exe
  2⤵
  PID:2920
- C:\Windows\System\TdLxMks.exe
  C:\Windows\System\TdLxMks.exe
  2⤵
  PID:2324
- C:\Windows\System\RsSrWfj.exe
  C:\Windows\System\RsSrWfj.exe
  2⤵
  PID:2876
- C:\Windows\System\Auinqrw.exe
  C:\Windows\System\Auinqrw.exe
  2⤵
  PID:1192
- C:\Windows\System\bIEGHqV.exe
  C:\Windows\System\bIEGHqV.exe
  2⤵
  PID:2124
- C:\Windows\System\WpuVDSL.exe
  C:\Windows\System\WpuVDSL.exe
  2⤵
  PID:3076
- C:\Windows\System\hnedizG.exe
  C:\Windows\System\hnedizG.exe
  2⤵
  PID:3092
- C:\Windows\System\NExswXu.exe
  C:\Windows\System\NExswXu.exe
  2⤵
  PID:3108
- C:\Windows\System\PlElqPQ.exe
  C:\Windows\System\PlElqPQ.exe
  2⤵
  PID:3124
- C:\Windows\System\tpgOFJM.exe
  C:\Windows\System\tpgOFJM.exe
  2⤵
  PID:3144
- C:\Windows\System\ZraNSbG.exe
  C:\Windows\System\ZraNSbG.exe
  2⤵
  PID:3160
- C:\Windows\System\tZhhION.exe
  C:\Windows\System\tZhhION.exe
  2⤵
  PID:3176
- C:\Windows\System\zNzoSJP.exe
  C:\Windows\System\zNzoSJP.exe
  2⤵
  PID:3192
- C:\Windows\System\xjUeNAq.exe
  C:\Windows\System\xjUeNAq.exe
  2⤵
  PID:3208
- C:\Windows\System\GLGPGcO.exe
  C:\Windows\System\GLGPGcO.exe
  2⤵
  PID:3224
- C:\Windows\System\TiWropP.exe
  C:\Windows\System\TiWropP.exe
  2⤵
  PID:3244
- C:\Windows\System\aPpthIs.exe
  C:\Windows\System\aPpthIs.exe
  2⤵
  PID:3268
- C:\Windows\System\SUSRIii.exe
  C:\Windows\System\SUSRIii.exe
  2⤵
  PID:3284
- C:\Windows\System\HhGNxGn.exe
  C:\Windows\System\HhGNxGn.exe
  2⤵
  PID:3344
- C:\Windows\System\FHKifnz.exe
  C:\Windows\System\FHKifnz.exe
  2⤵
  PID:3364
- C:\Windows\System\YhcUyzR.exe
  C:\Windows\System\YhcUyzR.exe
  2⤵
  PID:3384
- C:\Windows\System\NjSUbUK.exe
  C:\Windows\System\NjSUbUK.exe
  2⤵
  PID:3404
- C:\Windows\System\oLnITjU.exe
  C:\Windows\System\oLnITjU.exe
  2⤵
  PID:3424
- C:\Windows\System\TLVYLsK.exe
  C:\Windows\System\TLVYLsK.exe
  2⤵
  PID:3444
- C:\Windows\System\UhrLDvF.exe
  C:\Windows\System\UhrLDvF.exe
  2⤵
  PID:3468
- C:\Windows\System\HtNsWKh.exe
  C:\Windows\System\HtNsWKh.exe
  2⤵
  PID:3484
- C:\Windows\System\wTsDtuW.exe
  C:\Windows\System\wTsDtuW.exe
  2⤵
  PID:3500
- C:\Windows\System\mqxugnN.exe
  C:\Windows\System\mqxugnN.exe
  2⤵
  PID:3528
- C:\Windows\System\hMBuGle.exe
  C:\Windows\System\hMBuGle.exe
  2⤵
  PID:3544
- C:\Windows\System\QepVgaU.exe
  C:\Windows\System\QepVgaU.exe
  2⤵
  PID:3568
- C:\Windows\System\XgidGdr.exe
  C:\Windows\System\XgidGdr.exe
  2⤵
  PID:3584
- C:\Windows\System\MGNAoFC.exe
  C:\Windows\System\MGNAoFC.exe
  2⤵
  PID:3608
- C:\Windows\System\YSrTicN.exe
  C:\Windows\System\YSrTicN.exe
  2⤵
  PID:3624
- C:\Windows\System\SqPZgoL.exe
  C:\Windows\System\SqPZgoL.exe
  2⤵
  PID:3644
- C:\Windows\System\bOKWhPR.exe
  C:\Windows\System\bOKWhPR.exe
  2⤵
  PID:3664
- C:\Windows\System\XpLGuRk.exe
  C:\Windows\System\XpLGuRk.exe
  2⤵
  PID:3688
- C:\Windows\System\nVRCzSh.exe
  C:\Windows\System\nVRCzSh.exe
  2⤵
  PID:3704
- C:\Windows\System\KdFMHlL.exe
  C:\Windows\System\KdFMHlL.exe
  2⤵
  PID:3728
- C:\Windows\System\ndzvlIC.exe
  C:\Windows\System\ndzvlIC.exe
  2⤵
  PID:3744
- C:\Windows\System\efnZKyj.exe
  C:\Windows\System\efnZKyj.exe
  2⤵
  PID:3764
- C:\Windows\System\rateqvC.exe
  C:\Windows\System\rateqvC.exe
  2⤵
  PID:3788
- C:\Windows\System\HOYDhhe.exe
  C:\Windows\System\HOYDhhe.exe
  2⤵
  PID:3808
- C:\Windows\System\mVMRkhQ.exe
  C:\Windows\System\mVMRkhQ.exe
  2⤵
  PID:3828
- C:\Windows\System\LHbfGGB.exe
  C:\Windows\System\LHbfGGB.exe
  2⤵
  PID:3848
- C:\Windows\System\mbiFzuF.exe
  C:\Windows\System\mbiFzuF.exe
  2⤵
  PID:3872
- C:\Windows\System\oLYTIGR.exe
  C:\Windows\System\oLYTIGR.exe
  2⤵
  PID:3888
- C:\Windows\System\tebEoNC.exe
  C:\Windows\System\tebEoNC.exe
  2⤵
  PID:3908
- C:\Windows\System\rrsCORo.exe
  C:\Windows\System\rrsCORo.exe
  2⤵
  PID:3948
- C:\Windows\System\EiKJAZI.exe
  C:\Windows\System\EiKJAZI.exe
  2⤵
  PID:3968
- C:\Windows\System\qCzpdOM.exe
  C:\Windows\System\qCzpdOM.exe
  2⤵
  PID:3984
- C:\Windows\System\bqJGDeH.exe
  C:\Windows\System\bqJGDeH.exe
  2⤵
  PID:4004
- C:\Windows\System\LGitrhF.exe
  C:\Windows\System\LGitrhF.exe
  2⤵
  PID:4024
- C:\Windows\System\fazAGHX.exe
  C:\Windows\System\fazAGHX.exe
  2⤵
  PID:4044
- C:\Windows\System\JodBVst.exe
  C:\Windows\System\JodBVst.exe
  2⤵
  PID:4064
- C:\Windows\System\SuEuShr.exe
  C:\Windows\System\SuEuShr.exe
  2⤵
  PID:4088
- C:\Windows\System\vgJRNmr.exe
  C:\Windows\System\vgJRNmr.exe
  2⤵
  PID:2652
- C:\Windows\System\KZNKfPk.exe
  C:\Windows\System\KZNKfPk.exe
  2⤵
  PID:2788
- C:\Windows\System\xwtLsMb.exe
  C:\Windows\System\xwtLsMb.exe
  2⤵
  PID:732
- C:\Windows\System\JlYJkBZ.exe
  C:\Windows\System\JlYJkBZ.exe
  2⤵
  PID:3004
- C:\Windows\System\RRzQoZi.exe
  C:\Windows\System\RRzQoZi.exe
  2⤵
  PID:3200
- C:\Windows\System\QTcyBLr.exe
  C:\Windows\System\QTcyBLr.exe
  2⤵
  PID:3136
- C:\Windows\System\RZiTLzj.exe
  C:\Windows\System\RZiTLzj.exe
  2⤵
  PID:3216
- C:\Windows\System\XxnsrVC.exe
  C:\Windows\System\XxnsrVC.exe
  2⤵
  PID:3260
- C:\Windows\System\vxAeXqM.exe
  C:\Windows\System\vxAeXqM.exe
  2⤵
  PID:3312
- C:\Windows\System\VXralbl.exe
  C:\Windows\System\VXralbl.exe
  2⤵
  PID:3328
- C:\Windows\System\guywZEw.exe
  C:\Windows\System\guywZEw.exe
  2⤵
  PID:3336
- C:\Windows\System\SdOTCEc.exe
  C:\Windows\System\SdOTCEc.exe
  2⤵
  PID:3372
- C:\Windows\System\FCnaOli.exe
  C:\Windows\System\FCnaOli.exe
  2⤵
  PID:3396
- C:\Windows\System\HxBhiqP.exe
  C:\Windows\System\HxBhiqP.exe
  2⤵
  PID:2620
- C:\Windows\System\bpaODJs.exe
  C:\Windows\System\bpaODJs.exe
  2⤵
  PID:2420
- C:\Windows\System\SZEmnvu.exe
  C:\Windows\System\SZEmnvu.exe
  2⤵
  PID:3476
- C:\Windows\System\ynlWmHK.exe
  C:\Windows\System\ynlWmHK.exe
  2⤵
  PID:3512
- C:\Windows\System\vUnJEuZ.exe
  C:\Windows\System\vUnJEuZ.exe
  2⤵
  PID:3540
- C:\Windows\System\bFOivEZ.exe
  C:\Windows\System\bFOivEZ.exe
  2⤵
  PID:3556
- C:\Windows\System\LqUWaGx.exe
  C:\Windows\System\LqUWaGx.exe
  2⤵
  PID:3600
- C:\Windows\System\BjvDhSU.exe
  C:\Windows\System\BjvDhSU.exe
  2⤵
  PID:664
- C:\Windows\System\ktIcPfx.exe
  C:\Windows\System\ktIcPfx.exe
  2⤵
  PID:3636
- C:\Windows\System\KtdOOvz.exe
  C:\Windows\System\KtdOOvz.exe
  2⤵
  PID:3680
- C:\Windows\System\fSayTtj.exe
  C:\Windows\System\fSayTtj.exe
  2⤵
  PID:3700
- C:\Windows\System\XfZriwh.exe
  C:\Windows\System\XfZriwh.exe
  2⤵
  PID:3796
- C:\Windows\System\bfeeqEi.exe
  C:\Windows\System\bfeeqEi.exe
  2⤵
  PID:3816
- C:\Windows\System\WcsupIP.exe
  C:\Windows\System\WcsupIP.exe
  2⤵
  PID:3856
- C:\Windows\System\ELWSJSD.exe
  C:\Windows\System\ELWSJSD.exe
  2⤵
  PID:3884
- C:\Windows\System\hhTzZgz.exe
  C:\Windows\System\hhTzZgz.exe
  2⤵
  PID:3916
- C:\Windows\System\DlkJSex.exe
  C:\Windows\System\DlkJSex.exe
  2⤵
  PID:3924
- C:\Windows\System\qiPfdWf.exe
  C:\Windows\System\qiPfdWf.exe
  2⤵
  PID:3940
- C:\Windows\System\jTrqgWM.exe
  C:\Windows\System\jTrqgWM.exe
  2⤵
  PID:3980
- C:\Windows\System\osaAbrJ.exe
  C:\Windows\System\osaAbrJ.exe
  2⤵
  PID:4012
- C:\Windows\System\PaiQYXx.exe
  C:\Windows\System\PaiQYXx.exe
  2⤵
  PID:4040
- C:\Windows\System\aiEpYOX.exe
  C:\Windows\System\aiEpYOX.exe
  2⤵
  PID:4056
- C:\Windows\System\ltPvddQ.exe
  C:\Windows\System\ltPvddQ.exe
  2⤵
  PID:4076
- C:\Windows\System\ioXjDYn.exe
  C:\Windows\System\ioXjDYn.exe
  2⤵
  PID:3188
- C:\Windows\System\QOZvsWQ.exe
  C:\Windows\System\QOZvsWQ.exe
  2⤵
  PID:3104
- C:\Windows\System\wRRJbig.exe
  C:\Windows\System\wRRJbig.exe
  2⤵
  PID:2672
- C:\Windows\System\XKVTRuF.exe
  C:\Windows\System\XKVTRuF.exe
  2⤵
  PID:3140
- C:\Windows\System\hjKTyYg.exe
  C:\Windows\System\hjKTyYg.exe
  2⤵
  PID:3276
- C:\Windows\System\briAcFU.exe
  C:\Windows\System\briAcFU.exe
  2⤵
  PID:3292
- C:\Windows\System\JJVJALe.exe
  C:\Windows\System\JJVJALe.exe
  2⤵
  PID:3332
- C:\Windows\System\npREOQC.exe
  C:\Windows\System\npREOQC.exe
  2⤵
  PID:3400
- C:\Windows\System\EABLXsA.exe
  C:\Windows\System\EABLXsA.exe
  2⤵
  PID:3356
- C:\Windows\System\yyCTXyN.exe
  C:\Windows\System\yyCTXyN.exe
  2⤵
  PID:3564
- C:\Windows\System\BMInrht.exe
  C:\Windows\System\BMInrht.exe
  2⤵
  PID:4016
- C:\Windows\System\fZjpwPt.exe
  C:\Windows\System\fZjpwPt.exe
  2⤵
  PID:3132
- C:\Windows\System\ScKYgmj.exe
  C:\Windows\System\ScKYgmj.exe
  2⤵
  PID:3436
- C:\Windows\System\IOCeqzG.exe
  C:\Windows\System\IOCeqzG.exe
  2⤵
  PID:3780
- C:\Windows\System\MKyeJyB.exe
  C:\Windows\System\MKyeJyB.exe
  2⤵
  PID:3308
- C:\Windows\System\RcwZmSd.exe
  C:\Windows\System\RcwZmSd.exe
  2⤵
  PID:3756
- C:\Windows\System\heUGJlM.exe
  C:\Windows\System\heUGJlM.exe
  2⤵
  PID:3836
- C:\Windows\System\RNypoUy.exe
  C:\Windows\System\RNypoUy.exe
  2⤵
  PID:3840
- C:\Windows\System\emmSLml.exe
  C:\Windows\System\emmSLml.exe
  2⤵
  PID:4060
- C:\Windows\System\LxbKLLM.exe
  C:\Windows\System\LxbKLLM.exe
  2⤵
  PID:3184
- C:\Windows\System\gpEWWOt.exe
  C:\Windows\System\gpEWWOt.exe
  2⤵
  PID:3412
- C:\Windows\System\gFiTpVa.exe
  C:\Windows\System\gFiTpVa.exe
  2⤵
  PID:3520
- C:\Windows\System\rTnWlTB.exe
  C:\Windows\System\rTnWlTB.exe
  2⤵
  PID:3560
- C:\Windows\System\rUxdOqo.exe
  C:\Windows\System\rUxdOqo.exe
  2⤵
  PID:3860
- C:\Windows\System\jtPkJPH.exe
  C:\Windows\System\jtPkJPH.exe
  2⤵
  PID:3672
- C:\Windows\System\FiYEDvx.exe
  C:\Windows\System\FiYEDvx.exe
  2⤵
  PID:3168
- C:\Windows\System\VVNhnqv.exe
  C:\Windows\System\VVNhnqv.exe
  2⤵
  PID:1468
- C:\Windows\System\zcKxfjD.exe
  C:\Windows\System\zcKxfjD.exe
  2⤵
  PID:3256
- C:\Windows\System\bwJeuNH.exe
  C:\Windows\System\bwJeuNH.exe
  2⤵
  PID:3956
- C:\Windows\System\WHVeCFb.exe
  C:\Windows\System\WHVeCFb.exe
  2⤵
  PID:3904
- C:\Windows\System\LNsSmdK.exe
  C:\Windows\System\LNsSmdK.exe
  2⤵
  PID:3900
- C:\Windows\System\GMtoyzK.exe
  C:\Windows\System\GMtoyzK.exe
  2⤵
  PID:3152
- C:\Windows\System\TYNaucr.exe
  C:\Windows\System\TYNaucr.exe
  2⤵
  PID:4108
- C:\Windows\System\RmazGWV.exe
  C:\Windows\System\RmazGWV.exe
  2⤵
  PID:4124
- C:\Windows\System\qOAWsBV.exe
  C:\Windows\System\qOAWsBV.exe
  2⤵
  PID:4140
- C:\Windows\System\DfbwzmT.exe
  C:\Windows\System\DfbwzmT.exe
  2⤵
  PID:4232
- C:\Windows\System\emGcbrZ.exe
  C:\Windows\System\emGcbrZ.exe
  2⤵
  PID:4248
- C:\Windows\System\vKGoPnk.exe
  C:\Windows\System\vKGoPnk.exe
  2⤵
  PID:4264
- C:\Windows\System\JnbMsJv.exe
  C:\Windows\System\JnbMsJv.exe
  2⤵
  PID:4280
- C:\Windows\System\szkVXVC.exe
  C:\Windows\System\szkVXVC.exe
  2⤵
  PID:4300
- C:\Windows\System\NVNZkZT.exe
  C:\Windows\System\NVNZkZT.exe
  2⤵
  PID:4316
- C:\Windows\System\emwVKDl.exe
  C:\Windows\System\emwVKDl.exe
  2⤵
  PID:4332
- C:\Windows\System\lGRGWUz.exe
  C:\Windows\System\lGRGWUz.exe
  2⤵
  PID:4348
- C:\Windows\System\grrUWhZ.exe
  C:\Windows\System\grrUWhZ.exe
  2⤵
  PID:4364
- C:\Windows\System\yDQGcbb.exe
  C:\Windows\System\yDQGcbb.exe
  2⤵
  PID:4380
- C:\Windows\System\JddcvwL.exe
  C:\Windows\System\JddcvwL.exe
  2⤵
  PID:4396
- C:\Windows\System\gpRTjZu.exe
  C:\Windows\System\gpRTjZu.exe
  2⤵
  PID:4412
- C:\Windows\System\YKsOBFk.exe
  C:\Windows\System\YKsOBFk.exe
  2⤵
  PID:4428
- C:\Windows\System\RozWLEK.exe
  C:\Windows\System\RozWLEK.exe
  2⤵
  PID:4444
- C:\Windows\System\NIKoyDR.exe
  C:\Windows\System\NIKoyDR.exe
  2⤵
  PID:4464
- C:\Windows\System\etxkDwm.exe
  C:\Windows\System\etxkDwm.exe
  2⤵
  PID:4480
- C:\Windows\System\ANDXPUn.exe
  C:\Windows\System\ANDXPUn.exe
  2⤵
  PID:4496
- C:\Windows\System\pmomUfk.exe
  C:\Windows\System\pmomUfk.exe
  2⤵
  PID:4512
- C:\Windows\System\uNZWjrg.exe
  C:\Windows\System\uNZWjrg.exe
  2⤵
  PID:4528
- C:\Windows\System\ZHPLxEG.exe
  C:\Windows\System\ZHPLxEG.exe
  2⤵
  PID:4544
- C:\Windows\System\IQNnECB.exe
  C:\Windows\System\IQNnECB.exe
  2⤵
  PID:4560
- C:\Windows\System\tIkgwXu.exe
  C:\Windows\System\tIkgwXu.exe
  2⤵
  PID:4576
- C:\Windows\System\tAVcQWt.exe
  C:\Windows\System\tAVcQWt.exe
  2⤵
  PID:4596
- C:\Windows\System\ZOfAToB.exe
  C:\Windows\System\ZOfAToB.exe
  2⤵
  PID:4612
- C:\Windows\System\nrwqvuY.exe
  C:\Windows\System\nrwqvuY.exe
  2⤵
  PID:4628
- C:\Windows\System\QDaiUOR.exe
  C:\Windows\System\QDaiUOR.exe
  2⤵
  PID:4644
- C:\Windows\System\koEUVDO.exe
  C:\Windows\System\koEUVDO.exe
  2⤵
  PID:4664
- C:\Windows\System\pXgGAZv.exe
  C:\Windows\System\pXgGAZv.exe
  2⤵
  PID:4680
- C:\Windows\System\PEqCsYQ.exe
  C:\Windows\System\PEqCsYQ.exe
  2⤵
  PID:4700
- C:\Windows\System\yRvxICv.exe
  C:\Windows\System\yRvxICv.exe
  2⤵
  PID:4716
- C:\Windows\System\jYpYIEm.exe
  C:\Windows\System\jYpYIEm.exe
  2⤵
  PID:4732
- C:\Windows\System\DWdvbBY.exe
  C:\Windows\System\DWdvbBY.exe
  2⤵
  PID:4748
- C:\Windows\System\kItBLwD.exe
  C:\Windows\System\kItBLwD.exe
  2⤵
  PID:4820
- C:\Windows\System\JyuxpqH.exe
  C:\Windows\System\JyuxpqH.exe
  2⤵
  PID:4840
- C:\Windows\System\FlQXSlA.exe
  C:\Windows\System\FlQXSlA.exe
  2⤵
  PID:4856
- C:\Windows\System\lUIuRrp.exe
  C:\Windows\System\lUIuRrp.exe
  2⤵
  PID:4872
- C:\Windows\System\BqXQioo.exe
  C:\Windows\System\BqXQioo.exe
  2⤵
  PID:4888
- C:\Windows\System\lTgYekD.exe
  C:\Windows\System\lTgYekD.exe
  2⤵
  PID:4904
- C:\Windows\System\FqBigsw.exe
  C:\Windows\System\FqBigsw.exe
  2⤵
  PID:4920
- C:\Windows\System\fALgePU.exe
  C:\Windows\System\fALgePU.exe
  2⤵
  PID:4936
- C:\Windows\System\OJgvqss.exe
  C:\Windows\System\OJgvqss.exe
  2⤵
  PID:4952
- C:\Windows\System\cLRGyyd.exe
  C:\Windows\System\cLRGyyd.exe
  2⤵
  PID:4972
- C:\Windows\System\znGxfnf.exe
  C:\Windows\System\znGxfnf.exe
  2⤵
  PID:4988
- C:\Windows\System\aiBlOHT.exe
  C:\Windows\System\aiBlOHT.exe
  2⤵
  PID:5004
- C:\Windows\System\HRWlQTK.exe
  C:\Windows\System\HRWlQTK.exe
  2⤵
  PID:5020
- C:\Windows\System\vxKFbCh.exe
  C:\Windows\System\vxKFbCh.exe
  2⤵
  PID:5040
- C:\Windows\System\UiOunOa.exe
  C:\Windows\System\UiOunOa.exe
  2⤵
  PID:5056
- C:\Windows\System\qPgraSy.exe
  C:\Windows\System\qPgraSy.exe
  2⤵
  PID:5076
- C:\Windows\System\cTAUYvq.exe
  C:\Windows\System\cTAUYvq.exe
  2⤵
  PID:5100
- C:\Windows\System\HJMdaOW.exe
  C:\Windows\System\HJMdaOW.exe
  2⤵
  PID:5116
- C:\Windows\System\OOBoPcp.exe
  C:\Windows\System\OOBoPcp.exe
  2⤵
  PID:4000
- C:\Windows\System\JIwcvKY.exe
  C:\Windows\System\JIwcvKY.exe
  2⤵
  PID:3516
- C:\Windows\System\OPEjOmG.exe
  C:\Windows\System\OPEjOmG.exe
  2⤵
  PID:4080
- C:\Windows\System\TuNfurX.exe
  C:\Windows\System\TuNfurX.exe
  2⤵
  PID:3676
- C:\Windows\System\LVmcOgd.exe
  C:\Windows\System\LVmcOgd.exe
  2⤵
  PID:4116
- C:\Windows\System\scBsSEt.exe
  C:\Windows\System\scBsSEt.exe
  2⤵
  PID:3596
- C:\Windows\System\lROUJOK.exe
  C:\Windows\System\lROUJOK.exe
  2⤵
  PID:3616
- C:\Windows\System\KFElfXg.exe
  C:\Windows\System\KFElfXg.exe
  2⤵
  PID:3456
- C:\Windows\System\BqtZFfW.exe
  C:\Windows\System\BqtZFfW.exe
  2⤵
  PID:3720
- C:\Windows\System\GudZbwE.exe
  C:\Windows\System\GudZbwE.exe
  2⤵
  PID:3804
- C:\Windows\System\qYNLkbo.exe
  C:\Windows\System\qYNLkbo.exe
  2⤵
  PID:4180
- C:\Windows\System\BvnsCVL.exe
  C:\Windows\System\BvnsCVL.exe
  2⤵
  PID:4292
- C:\Windows\System\mitBBri.exe
  C:\Windows\System\mitBBri.exe
  2⤵
  PID:4228
- C:\Windows\System\OcBAinh.exe
  C:\Windows\System\OcBAinh.exe
  2⤵
  PID:4276
- C:\Windows\System\UQcRVGK.exe
  C:\Windows\System\UQcRVGK.exe
  2⤵
  PID:4344
- C:\Windows\System\OecFPrj.exe
  C:\Windows\System\OecFPrj.exe
  2⤵
  PID:4436
- C:\Windows\System\cTcdhzZ.exe
  C:\Windows\System\cTcdhzZ.exe
  2⤵
  PID:4296
- C:\Windows\System\jwUBkoB.exe
  C:\Windows\System\jwUBkoB.exe
  2⤵
  PID:4508
- C:\Windows\System\xmmzYeZ.exe
  C:\Windows\System\xmmzYeZ.exe
  2⤵
  PID:4572
- C:\Windows\System\uwoAUSs.exe
  C:\Windows\System\uwoAUSs.exe
  2⤵
  PID:4636
- C:\Windows\System\RqPalZd.exe
  C:\Windows\System\RqPalZd.exe
  2⤵
  PID:4712
- C:\Windows\System\iprhmfa.exe
  C:\Windows\System\iprhmfa.exe
  2⤵
  PID:4552
- C:\Windows\System\yIDCzki.exe
  C:\Windows\System\yIDCzki.exe
  2⤵
  PID:4692
- C:\Windows\System\rNapmuB.exe
  C:\Windows\System\rNapmuB.exe
  2⤵
  PID:4624
- C:\Windows\System\BDnqapX.exe
  C:\Windows\System\BDnqapX.exe
  2⤵
  PID:4724
- C:\Windows\System\uxVNZgi.exe
  C:\Windows\System\uxVNZgi.exe
  2⤵
  PID:4688
- C:\Windows\System\fToVRow.exe
  C:\Windows\System\fToVRow.exe
  2⤵
  PID:4772
- C:\Windows\System\tJwCQTn.exe
  C:\Windows\System\tJwCQTn.exe
  2⤵
  PID:4800
- C:\Windows\System\ublFspB.exe
  C:\Windows\System\ublFspB.exe
  2⤵
  PID:4848
- C:\Windows\System\jvsEoil.exe
  C:\Windows\System\jvsEoil.exe
  2⤵
  PID:4944
- C:\Windows\System\qzdrBse.exe
  C:\Windows\System\qzdrBse.exe
  2⤵
  PID:4864
- C:\Windows\System\VnJwXhE.exe
  C:\Windows\System\VnJwXhE.exe
  2⤵
  PID:4836
- C:\Windows\System\PMAIoqY.exe
  C:\Windows\System\PMAIoqY.exe
  2⤵
  PID:4912
- C:\Windows\System\FNKlGhN.exe
  C:\Windows\System\FNKlGhN.exe
  2⤵
  PID:4104
- C:\Windows\System\VukGoab.exe
  C:\Windows\System\VukGoab.exe
  2⤵
  PID:4900
- C:\Windows\System\RxOiSzg.exe
  C:\Windows\System\RxOiSzg.exe
  2⤵
  PID:4964
- C:\Windows\System\PEsWsMr.exe
  C:\Windows\System\PEsWsMr.exe
  2⤵
  PID:5036
- C:\Windows\System\mXalWaP.exe
  C:\Windows\System\mXalWaP.exe
  2⤵
  PID:4160
- C:\Windows\System\qeHBNYT.exe
  C:\Windows\System\qeHBNYT.exe
  2⤵
  PID:4120
- C:\Windows\System\mXsjSAC.exe
  C:\Windows\System\mXsjSAC.exe
  2⤵
  PID:5096
- C:\Windows\System\kANryHf.exe
  C:\Windows\System\kANryHf.exe
  2⤵
  PID:3280
- C:\Windows\System\wcWUdtf.exe
  C:\Windows\System\wcWUdtf.exe
  2⤵
  PID:4200
- C:\Windows\System\XBjXonN.exe
  C:\Windows\System\XBjXonN.exe
  2⤵
  PID:1848
- C:\Windows\System\muQMkaX.exe
  C:\Windows\System\muQMkaX.exe
  2⤵
  PID:3432
- C:\Windows\System\CdHSqse.exe
  C:\Windows\System\CdHSqse.exe
  2⤵
  PID:3656
- C:\Windows\System\MRoJmFS.exe
  C:\Windows\System\MRoJmFS.exe
  2⤵
  PID:4340
- C:\Windows\System\glSgecs.exe
  C:\Windows\System\glSgecs.exe
  2⤵
  PID:4220
- C:\Windows\System\bKdZvto.exe
  C:\Windows\System\bKdZvto.exe
  2⤵
  PID:4568
- C:\Windows\System\MIexlpV.exe
  C:\Windows\System\MIexlpV.exe
  2⤵
  PID:2568
- C:\Windows\System\kbQXVpb.exe
  C:\Windows\System\kbQXVpb.exe
  2⤵
  PID:4376
- C:\Windows\System\dsFyLVg.exe
  C:\Windows\System\dsFyLVg.exe
  2⤵
  PID:4588
- C:\Windows\System\aiQyzKN.exe
  C:\Windows\System\aiQyzKN.exe
  2⤵
  PID:4764
- C:\Windows\System\ZapJcLu.exe
  C:\Windows\System\ZapJcLu.exe
  2⤵
  PID:5048
- C:\Windows\System\zqVUmmY.exe
  C:\Windows\System\zqVUmmY.exe
  2⤵
  PID:4424
- C:\Windows\System\KgfSeGt.exe
  C:\Windows\System\KgfSeGt.exe
  2⤵
  PID:4456
- C:\Windows\System\NsDisRr.exe
  C:\Windows\System\NsDisRr.exe
  2⤵
  PID:4492
- C:\Windows\System\wClWQzd.exe
  C:\Windows\System\wClWQzd.exe
  2⤵
  PID:4744
- C:\Windows\System\UGuxtXV.exe
  C:\Windows\System\UGuxtXV.exe
  2⤵
  PID:4808
- C:\Windows\System\TsTPyoB.exe
  C:\Windows\System\TsTPyoB.exe
  2⤵
  PID:5028
- C:\Windows\System\JMNJKcK.exe
  C:\Windows\System\JMNJKcK.exe
  2⤵
  PID:4172
- C:\Windows\System\sDkrjTh.exe
  C:\Windows\System\sDkrjTh.exe
  2⤵
  PID:4192
- C:\Windows\System\wpQPqpo.exe
  C:\Windows\System\wpQPqpo.exe
  2⤵
  PID:3736
- C:\Windows\System\yJDgTYC.exe
  C:\Windows\System\yJDgTYC.exe
  2⤵
  PID:3452
- C:\Windows\System\UfPWuDx.exe
  C:\Windows\System\UfPWuDx.exe
  2⤵
  PID:4440
- C:\Windows\System\uAfkUSi.exe
  C:\Windows\System\uAfkUSi.exe
  2⤵
  PID:4696
- C:\Windows\System\CwWSoKH.exe
  C:\Windows\System\CwWSoKH.exe
  2⤵
  PID:4288
- C:\Windows\System\uAaHyZQ.exe
  C:\Windows\System\uAaHyZQ.exe
  2⤵
  PID:4756
- C:\Windows\System\zwIgksP.exe
  C:\Windows\System\zwIgksP.exe
  2⤵
  PID:4604
- C:\Windows\System\acRSzPl.exe
  C:\Windows\System\acRSzPl.exe
  2⤵
  PID:5016
- C:\Windows\System\UUTCsVs.exe
  C:\Windows\System\UUTCsVs.exe
  2⤵
  PID:4148
- C:\Windows\System\TvXUKut.exe
  C:\Windows\System\TvXUKut.exe
  2⤵
  PID:4652
- C:\Windows\System\fYrDIht.exe
  C:\Windows\System\fYrDIht.exe
  2⤵
  PID:4932
- C:\Windows\System\GaIfAYO.exe
  C:\Windows\System\GaIfAYO.exe
  2⤵
  PID:5136
- C:\Windows\System\RKXxWJx.exe
  C:\Windows\System\RKXxWJx.exe
  2⤵
  PID:5152
- C:\Windows\System\cGQkKYD.exe
  C:\Windows\System\cGQkKYD.exe
  2⤵
  PID:5172
- C:\Windows\System\QSGMtoD.exe
  C:\Windows\System\QSGMtoD.exe
  2⤵
  PID:5188
- C:\Windows\System\TBdsriu.exe
  C:\Windows\System\TBdsriu.exe
  2⤵
  PID:5204
- C:\Windows\System\InZdnMF.exe
  C:\Windows\System\InZdnMF.exe
  2⤵
  PID:5220
- C:\Windows\System\gtdWCiE.exe
  C:\Windows\System\gtdWCiE.exe
  2⤵
  PID:5236
- C:\Windows\System\FvFZEvy.exe
  C:\Windows\System\FvFZEvy.exe
  2⤵
  PID:5260
- C:\Windows\System\eNRQMbG.exe
  C:\Windows\System\eNRQMbG.exe
  2⤵
  PID:5280
- C:\Windows\System\JgfrvFO.exe
  C:\Windows\System\JgfrvFO.exe
  2⤵
  PID:5296
- C:\Windows\System\QPnTsGd.exe
  C:\Windows\System\QPnTsGd.exe
  2⤵
  PID:5320
- C:\Windows\System\zeRpaMT.exe
  C:\Windows\System\zeRpaMT.exe
  2⤵
  PID:5336
- C:\Windows\System\NqLrdFR.exe
  C:\Windows\System\NqLrdFR.exe
  2⤵
  PID:5352
- C:\Windows\System\lKsayZT.exe
  C:\Windows\System\lKsayZT.exe
  2⤵
  PID:5368
- C:\Windows\System\XpIJmar.exe
  C:\Windows\System\XpIJmar.exe
  2⤵
  PID:5384
- C:\Windows\System\yMTDglg.exe
  C:\Windows\System\yMTDglg.exe
  2⤵
  PID:5408
- C:\Windows\System\HDIbJzT.exe
  C:\Windows\System\HDIbJzT.exe
  2⤵
  PID:5432
- C:\Windows\System\kFSTWME.exe
  C:\Windows\System\kFSTWME.exe
  2⤵
  PID:5448
- C:\Windows\System\wObLNiW.exe
  C:\Windows\System\wObLNiW.exe
  2⤵
  PID:5464
- C:\Windows\System\dahKzEb.exe
  C:\Windows\System\dahKzEb.exe
  2⤵
  PID:5480
- C:\Windows\System\YuWrEco.exe
  C:\Windows\System\YuWrEco.exe
  2⤵
  PID:5496
- C:\Windows\System\auOIiza.exe
  C:\Windows\System\auOIiza.exe
  2⤵
  PID:5512
- C:\Windows\System\zFUlFeA.exe
  C:\Windows\System\zFUlFeA.exe
  2⤵
  PID:5528
- C:\Windows\System\kJpFFnG.exe
  C:\Windows\System\kJpFFnG.exe
  2⤵
  PID:5544
- C:\Windows\System\axmhuNZ.exe
  C:\Windows\System\axmhuNZ.exe
  2⤵
  PID:5620
- C:\Windows\System\ZDvQBNj.exe
  C:\Windows\System\ZDvQBNj.exe
  2⤵
  PID:5636
- C:\Windows\System\NtBXUVi.exe
  C:\Windows\System\NtBXUVi.exe
  2⤵
  PID:5652
- C:\Windows\System\NGWkOJJ.exe
  C:\Windows\System\NGWkOJJ.exe
  2⤵
  PID:5668
- C:\Windows\System\avMuWgI.exe
  C:\Windows\System\avMuWgI.exe
  2⤵
  PID:5684
- C:\Windows\System\qKsLxXz.exe
  C:\Windows\System\qKsLxXz.exe
  2⤵
  PID:5700
- C:\Windows\System\mOWBwcA.exe
  C:\Windows\System\mOWBwcA.exe
  2⤵
  PID:5716
- C:\Windows\System\xRTWPGR.exe
  C:\Windows\System\xRTWPGR.exe
  2⤵
  PID:5732
- C:\Windows\System\OFyYHSi.exe
  C:\Windows\System\OFyYHSi.exe
  2⤵
  PID:5748
- C:\Windows\System\TVEiNeF.exe
  C:\Windows\System\TVEiNeF.exe
  2⤵
  PID:5764
- C:\Windows\System\efsXNpa.exe
  C:\Windows\System\efsXNpa.exe
  2⤵
  PID:5780
- C:\Windows\System\CXuTVvW.exe
  C:\Windows\System\CXuTVvW.exe
  2⤵
  PID:5796
- C:\Windows\System\JxRhvuC.exe
  C:\Windows\System\JxRhvuC.exe
  2⤵
  PID:5812
- C:\Windows\System\zCpZxbJ.exe
  C:\Windows\System\zCpZxbJ.exe
  2⤵
  PID:5828
- C:\Windows\System\FVFYMlb.exe
  C:\Windows\System\FVFYMlb.exe
  2⤵
  PID:5844
- C:\Windows\System\WMfsyrq.exe
  C:\Windows\System\WMfsyrq.exe
  2⤵
  PID:5860
- C:\Windows\System\eayKvcg.exe
  C:\Windows\System\eayKvcg.exe
  2⤵
  PID:5876
- C:\Windows\System\ExlxrlU.exe
  C:\Windows\System\ExlxrlU.exe
  2⤵
  PID:5892
- C:\Windows\System\rcBzUFR.exe
  C:\Windows\System\rcBzUFR.exe
  2⤵
  PID:5908
- C:\Windows\System\XEwRuFq.exe
  C:\Windows\System\XEwRuFq.exe
  2⤵
  PID:5928
- C:\Windows\System\kKqQycb.exe
  C:\Windows\System\kKqQycb.exe
  2⤵
  PID:5944
- C:\Windows\System\JRWbyYp.exe
  C:\Windows\System\JRWbyYp.exe
  2⤵
  PID:5960
- C:\Windows\System\WrbdAmq.exe
  C:\Windows\System\WrbdAmq.exe
  2⤵
  PID:5976
- C:\Windows\System\XKnxevT.exe
  C:\Windows\System\XKnxevT.exe
  2⤵
  PID:5992
- C:\Windows\System\TTXVdmc.exe
  C:\Windows\System\TTXVdmc.exe
  2⤵
  PID:6016
- C:\Windows\System\SBkiDMx.exe
  C:\Windows\System\SBkiDMx.exe
  2⤵
  PID:6032
- C:\Windows\System\msEcQkF.exe
  C:\Windows\System\msEcQkF.exe
  2⤵
  PID:6048
- C:\Windows\System\YjpKEYC.exe
  C:\Windows\System\YjpKEYC.exe
  2⤵
  PID:6064
- C:\Windows\System\PcrpuhQ.exe
  C:\Windows\System\PcrpuhQ.exe
  2⤵
  PID:6080
- C:\Windows\System\RloiRYj.exe
  C:\Windows\System\RloiRYj.exe
  2⤵
  PID:6096
- C:\Windows\System\jrbzYza.exe
  C:\Windows\System\jrbzYza.exe
  2⤵
  PID:6112
- C:\Windows\System\QSBBLGJ.exe
  C:\Windows\System\QSBBLGJ.exe
  2⤵
  PID:6132
- C:\Windows\System\JzgDtBX.exe
  C:\Windows\System\JzgDtBX.exe
  2⤵
  PID:5052
- C:\Windows\System\AAGRmcI.exe
  C:\Windows\System\AAGRmcI.exe
  2⤵
  PID:4328
- C:\Windows\System\lKryeIE.exe
  C:\Windows\System\lKryeIE.exe
  2⤵
  PID:4452
- C:\Windows\System\DdIUxLm.exe
  C:\Windows\System\DdIUxLm.exe
  2⤵
  PID:5132
- C:\Windows\System\wfZDuQI.exe
  C:\Windows\System\wfZDuQI.exe
  2⤵
  PID:5196
- C:\Windows\System\nClKDKZ.exe
  C:\Windows\System\nClKDKZ.exe
  2⤵
  PID:5276
- C:\Windows\System\pzNhkJm.exe
  C:\Windows\System\pzNhkJm.exe
  2⤵
  PID:5312
- C:\Windows\System\qhAshOA.exe
  C:\Windows\System\qhAshOA.exe
  2⤵
  PID:5380
- C:\Windows\System\AcWMjxE.exe
  C:\Windows\System\AcWMjxE.exe
  2⤵
  PID:3740
- C:\Windows\System\EvyOjAF.exe
  C:\Windows\System\EvyOjAF.exe
  2⤵
  PID:4816
- C:\Windows\System\LhPDAEP.exe
  C:\Windows\System\LhPDAEP.exe
  2⤵
  PID:4260
- C:\Windows\System\yMbHlUp.exe
  C:\Windows\System\yMbHlUp.exe
  2⤵
  PID:5144
- C:\Windows\System\MrmjunF.exe
  C:\Windows\System\MrmjunF.exe
  2⤵
  PID:5212
- C:\Windows\System\AZpsdwS.exe
  C:\Windows\System\AZpsdwS.exe
  2⤵
  PID:5256
- C:\Windows\System\lmYYVla.exe
  C:\Windows\System\lmYYVla.exe
  2⤵
  PID:5332
- C:\Windows\System\qZsjUfz.exe
  C:\Windows\System\qZsjUfz.exe
  2⤵
  PID:5400
- C:\Windows\System\zJBmKaR.exe
  C:\Windows\System\zJBmKaR.exe
  2⤵
  PID:3820
- C:\Windows\System\XcTVkrv.exe
  C:\Windows\System\XcTVkrv.exe
  2⤵
  PID:5440
- C:\Windows\System\CKrRpZO.exe
  C:\Windows\System\CKrRpZO.exe
  2⤵
  PID:5504
- C:\Windows\System\JIWiHdi.exe
  C:\Windows\System\JIWiHdi.exe
  2⤵
  PID:5612
- C:\Windows\System\cuJJgrc.exe
  C:\Windows\System\cuJJgrc.exe
  2⤵
  PID:5568
- C:\Windows\System\iENaCzt.exe
  C:\Windows\System\iENaCzt.exe
  2⤵
  PID:5428
- C:\Windows\System\ZCKxbAA.exe
  C:\Windows\System\ZCKxbAA.exe
  2⤵
  PID:5492
- C:\Windows\System\gpfALPU.exe
  C:\Windows\System\gpfALPU.exe
  2⤵
  PID:5588
- C:\Windows\System\DtYagcl.exe
  C:\Windows\System\DtYagcl.exe
  2⤵
  PID:5604
- C:\Windows\System\mwguESX.exe
  C:\Windows\System\mwguESX.exe
  2⤵
  PID:5644
- C:\Windows\System\HDhTCsM.exe
  C:\Windows\System\HDhTCsM.exe
  2⤵
  PID:5628
- C:\Windows\System\GysvEzq.exe
  C:\Windows\System\GysvEzq.exe
  2⤵
  PID:5632
- C:\Windows\System\xwjduNu.exe
  C:\Windows\System\xwjduNu.exe
  2⤵
  PID:5724
- C:\Windows\System\cbTmUnn.exe
  C:\Windows\System\cbTmUnn.exe
  2⤵
  PID:5740
- C:\Windows\System\lWAjMyh.exe
  C:\Windows\System\lWAjMyh.exe
  2⤵
  PID:5792
- C:\Windows\System\clpPghI.exe
  C:\Windows\System\clpPghI.exe
  2⤵
  PID:5856
- C:\Windows\System\TTDRXLz.exe
  C:\Windows\System\TTDRXLz.exe
  2⤵
  PID:5840
- C:\Windows\System\ttxzDdt.exe
  C:\Windows\System\ttxzDdt.exe
  2⤵
  PID:5916
- C:\Windows\System\ODKvAzv.exe
  C:\Windows\System\ODKvAzv.exe
  2⤵
  PID:5920
- C:\Windows\System\przkkZG.exe
  C:\Windows\System\przkkZG.exe
  2⤵
  PID:5956
- C:\Windows\System\gdRezxF.exe
  C:\Windows\System\gdRezxF.exe
  2⤵
  PID:5968
- C:\Windows\System\jDldEIw.exe
  C:\Windows\System\jDldEIw.exe
  2⤵
  PID:6008
- C:\Windows\System\KMnSqNV.exe
  C:\Windows\System\KMnSqNV.exe
  2⤵
  PID:6040
- C:\Windows\System\jAEkMzQ.exe
  C:\Windows\System\jAEkMzQ.exe
  2⤵
  PID:6072
- C:\Windows\System\WIVLohu.exe
  C:\Windows\System\WIVLohu.exe
  2⤵
  PID:6092
- C:\Windows\System\Gpjxnhj.exe
  C:\Windows\System\Gpjxnhj.exe
  2⤵
  PID:6108
- C:\Windows\System\fgYqpTZ.exe
  C:\Windows\System\fgYqpTZ.exe
  2⤵
  PID:4488
- C:\Windows\System\nTlnAGs.exe
  C:\Windows\System\nTlnAGs.exe
  2⤵
  PID:4272
- C:\Windows\System\hyRNxBh.exe
  C:\Windows\System\hyRNxBh.exe
  2⤵
  PID:4100
- C:\Windows\System\cwirlyJ.exe
  C:\Windows\System\cwirlyJ.exe
  2⤵
  PID:5128
- C:\Windows\System\VWUwccP.exe
  C:\Windows\System\VWUwccP.exe
  2⤵
  PID:5180
- C:\Windows\System\xHsacYl.exe
  C:\Windows\System\xHsacYl.exe
  2⤵
  PID:5396
- C:\Windows\System\GlSNhLT.exe
  C:\Windows\System\GlSNhLT.exe
  2⤵
  PID:4472
- C:\Windows\System\ojkzfKo.exe
  C:\Windows\System\ojkzfKo.exe
  2⤵
  PID:5420
- C:\Windows\System\EihzNga.exe
  C:\Windows\System\EihzNga.exe
  2⤵
  PID:5364
- C:\Windows\System\IGWIgeu.exe
  C:\Windows\System\IGWIgeu.exe
  2⤵
  PID:5564
- C:\Windows\System\UecEqDA.exe
  C:\Windows\System\UecEqDA.exe
  2⤵
  PID:5600
- C:\Windows\System\NHOIdGw.exe
  C:\Windows\System\NHOIdGw.exe
  2⤵
  PID:5616
- C:\Windows\System\KebxRoV.exe
  C:\Windows\System\KebxRoV.exe
  2⤵
  PID:5524
- C:\Windows\System\QCHvlNX.exe
  C:\Windows\System\QCHvlNX.exe
  2⤵
  PID:5660
- C:\Windows\System\cRlkHZV.exe
  C:\Windows\System\cRlkHZV.exe
  2⤵
  PID:5760
- C:\Windows\System\sYaLOSZ.exe
  C:\Windows\System\sYaLOSZ.exe
  2⤵
  PID:5788
- C:\Windows\System\qtITeHb.exe
  C:\Windows\System\qtITeHb.exe
  2⤵
  PID:6024
- C:\Windows\System\qpPPsxI.exe
  C:\Windows\System\qpPPsxI.exe
  2⤵
  PID:5064
- C:\Windows\System\OUTbncB.exe
  C:\Windows\System\OUTbncB.exe
  2⤵
  PID:5940
- C:\Windows\System\sfLrtWL.exe
  C:\Windows\System\sfLrtWL.exe
  2⤵
  PID:3064
- C:\Windows\System\pcXoQkB.exe
  C:\Windows\System\pcXoQkB.exe
  2⤵
  PID:5376
- C:\Windows\System\Zvuvoaa.exe
  C:\Windows\System\Zvuvoaa.exe
  2⤵
  PID:5460
- C:\Windows\System\tpRAnTK.exe
  C:\Windows\System\tpRAnTK.exe
  2⤵
  PID:5576
- C:\Windows\System\ysmZPgh.exe
  C:\Windows\System\ysmZPgh.exe
  2⤵
  PID:6044
- C:\Windows\System\qObvurO.exe
  C:\Windows\System\qObvurO.exe
  2⤵
  PID:5328
- C:\Windows\System\vSqaIbg.exe
  C:\Windows\System\vSqaIbg.exe
  2⤵
  PID:5292
- C:\Windows\System\HJaiAST.exe
  C:\Windows\System\HJaiAST.exe
  2⤵
  PID:5560
- C:\Windows\System\ThGBqrS.exe
  C:\Windows\System\ThGBqrS.exe
  2⤵
  PID:5592
- C:\Windows\System\bsIChhy.exe
  C:\Windows\System\bsIChhy.exe
  2⤵
  PID:5900
- C:\Windows\System\ffRnfbU.exe
  C:\Windows\System\ffRnfbU.exe
  2⤵
  PID:5348
- C:\Windows\System\pgjfWOG.exe
  C:\Windows\System\pgjfWOG.exe
  2⤵
  PID:5872
- C:\Windows\System\nOqMqII.exe
  C:\Windows\System\nOqMqII.exe
  2⤵
  PID:5252
- C:\Windows\System\tisBGnB.exe
  C:\Windows\System\tisBGnB.exe
  2⤵
  PID:6060
- C:\Windows\System\ZOZIHKf.exe
  C:\Windows\System\ZOZIHKf.exe
  2⤵
  PID:4708
- C:\Windows\System\qlVynJc.exe
  C:\Windows\System\qlVynJc.exe
  2⤵
  PID:5540
- C:\Windows\System\ywbWLNt.exe
  C:\Windows\System\ywbWLNt.exe
  2⤵
  PID:6124
- C:\Windows\System\uGcfOJy.exe
  C:\Windows\System\uGcfOJy.exe
  2⤵
  PID:5712
- C:\Windows\System\xZXwJaQ.exe
  C:\Windows\System\xZXwJaQ.exe
  2⤵
  PID:5972
- C:\Windows\System\izhjhNh.exe
  C:\Windows\System\izhjhNh.exe
  2⤵
  PID:5836
- C:\Windows\System\FscEYPW.exe
  C:\Windows\System\FscEYPW.exe
  2⤵
  PID:6156
- C:\Windows\System\ZbmGWJJ.exe
  C:\Windows\System\ZbmGWJJ.exe
  2⤵
  PID:6172
- C:\Windows\System\CatAReo.exe
  C:\Windows\System\CatAReo.exe
  2⤵
  PID:6188
- C:\Windows\System\spzzlve.exe
  C:\Windows\System\spzzlve.exe
  2⤵
  PID:6204
- C:\Windows\System\VQtxpkn.exe
  C:\Windows\System\VQtxpkn.exe
  2⤵
  PID:6220
- C:\Windows\System\zrWdSVb.exe
  C:\Windows\System\zrWdSVb.exe
  2⤵
  PID:6236
- C:\Windows\System\LkvvtpB.exe
  C:\Windows\System\LkvvtpB.exe
  2⤵
  PID:6252
- C:\Windows\System\OAOkoEQ.exe
  C:\Windows\System\OAOkoEQ.exe
  2⤵
  PID:6268
- C:\Windows\System\xffqNhA.exe
  C:\Windows\System\xffqNhA.exe
  2⤵
  PID:6284
- C:\Windows\System\xGbuSqA.exe
  C:\Windows\System\xGbuSqA.exe
  2⤵
  PID:6300
- C:\Windows\System\SCwJvXd.exe
  C:\Windows\System\SCwJvXd.exe
  2⤵
  PID:6316
- C:\Windows\System\zGyYaLv.exe
  C:\Windows\System\zGyYaLv.exe
  2⤵
  PID:6332
- C:\Windows\System\gJrOBkm.exe
  C:\Windows\System\gJrOBkm.exe
  2⤵
  PID:6348
- C:\Windows\System\zQpuEUJ.exe
  C:\Windows\System\zQpuEUJ.exe
  2⤵
  PID:6364
- C:\Windows\System\PPrFvqY.exe
  C:\Windows\System\PPrFvqY.exe
  2⤵
  PID:6380
- C:\Windows\System\foTfJwD.exe
  C:\Windows\System\foTfJwD.exe
  2⤵
  PID:6396
- C:\Windows\System\hzRXPoR.exe
  C:\Windows\System\hzRXPoR.exe
  2⤵
  PID:6412
- C:\Windows\System\mxSOQeI.exe
  C:\Windows\System\mxSOQeI.exe
  2⤵
  PID:6428
- C:\Windows\System\NABLgyJ.exe
  C:\Windows\System\NABLgyJ.exe
  2⤵
  PID:6444
- C:\Windows\System\XLXudct.exe
  C:\Windows\System\XLXudct.exe
  2⤵
  PID:6460
- C:\Windows\System\fFSBDcb.exe
  C:\Windows\System\fFSBDcb.exe
  2⤵
  PID:6476
- C:\Windows\System\megouEJ.exe
  C:\Windows\System\megouEJ.exe
  2⤵
  PID:6492
- C:\Windows\System\QhUtKkh.exe
  C:\Windows\System\QhUtKkh.exe
  2⤵
  PID:6508
- C:\Windows\System\vFAaZTn.exe
  C:\Windows\System\vFAaZTn.exe
  2⤵
  PID:6524
- C:\Windows\System\pMUxAao.exe
  C:\Windows\System\pMUxAao.exe
  2⤵
  PID:6540
- C:\Windows\System\WlrgBFV.exe
  C:\Windows\System\WlrgBFV.exe
  2⤵
  PID:6556
- C:\Windows\System\rSpwuvW.exe
  C:\Windows\System\rSpwuvW.exe
  2⤵
  PID:6572
- C:\Windows\System\opmoxeP.exe
  C:\Windows\System\opmoxeP.exe
  2⤵
  PID:6588
- C:\Windows\System\XgLJhIy.exe
  C:\Windows\System\XgLJhIy.exe
  2⤵
  PID:6604
- C:\Windows\System\OCANWxt.exe
  C:\Windows\System\OCANWxt.exe
  2⤵
  PID:6620
- C:\Windows\System\tgZyDJd.exe
  C:\Windows\System\tgZyDJd.exe
  2⤵
  PID:6636
- C:\Windows\System\MpVjsmg.exe
  C:\Windows\System\MpVjsmg.exe
  2⤵
  PID:6652
- C:\Windows\System\wsXWShz.exe
  C:\Windows\System\wsXWShz.exe
  2⤵
  PID:6668
- C:\Windows\System\OdbayTF.exe
  C:\Windows\System\OdbayTF.exe
  2⤵
  PID:6684
- C:\Windows\System\mjeMgNS.exe
  C:\Windows\System\mjeMgNS.exe
  2⤵
  PID:6700
- C:\Windows\System\wZDtInH.exe
  C:\Windows\System\wZDtInH.exe
  2⤵
  PID:6716
- C:\Windows\System\fFpcyzb.exe
  C:\Windows\System\fFpcyzb.exe
  2⤵
  PID:6732
- C:\Windows\System\ewlePvE.exe
  C:\Windows\System\ewlePvE.exe
  2⤵
  PID:6748
- C:\Windows\System\mzSvHPB.exe
  C:\Windows\System\mzSvHPB.exe
  2⤵
  PID:6764
- C:\Windows\System\otthcHO.exe
  C:\Windows\System\otthcHO.exe
  2⤵
  PID:6780
- C:\Windows\System\vrCFIjj.exe
  C:\Windows\System\vrCFIjj.exe
  2⤵
  PID:6796
- C:\Windows\System\YYmBVvl.exe
  C:\Windows\System\YYmBVvl.exe
  2⤵
  PID:6812
- C:\Windows\System\RKtYyxK.exe
  C:\Windows\System\RKtYyxK.exe
  2⤵
  PID:6828
- C:\Windows\System\SUAuiyS.exe
  C:\Windows\System\SUAuiyS.exe
  2⤵
  PID:6844
- C:\Windows\System\ciFjRso.exe
  C:\Windows\System\ciFjRso.exe
  2⤵
  PID:6860
- C:\Windows\System\vtNBVWz.exe
  C:\Windows\System\vtNBVWz.exe
  2⤵
  PID:6876
- C:\Windows\System\xdeMFNZ.exe
  C:\Windows\System\xdeMFNZ.exe
  2⤵
  PID:6892
- C:\Windows\System\AoUXMku.exe
  C:\Windows\System\AoUXMku.exe
  2⤵
  PID:6908
- C:\Windows\System\QvstWZd.exe
  C:\Windows\System\QvstWZd.exe
  2⤵
  PID:6924
- C:\Windows\System\BcvoqZc.exe
  C:\Windows\System\BcvoqZc.exe
  2⤵
  PID:6944
- C:\Windows\System\zmsYVJp.exe
  C:\Windows\System\zmsYVJp.exe
  2⤵
  PID:6960
- C:\Windows\System\CjNdnJc.exe
  C:\Windows\System\CjNdnJc.exe
  2⤵
  PID:6976
- C:\Windows\System\quGWNnp.exe
  C:\Windows\System\quGWNnp.exe
  2⤵
  PID:6992
- C:\Windows\System\xsMMEiG.exe
  C:\Windows\System\xsMMEiG.exe
  2⤵
  PID:7008
- C:\Windows\System\yjJBVMl.exe
  C:\Windows\System\yjJBVMl.exe
  2⤵
  PID:7024
- C:\Windows\System\UebsxSS.exe
  C:\Windows\System\UebsxSS.exe
  2⤵
  PID:7040
- C:\Windows\System\nanOgFr.exe
  C:\Windows\System\nanOgFr.exe
  2⤵
  PID:7056
- C:\Windows\System\NdxChXH.exe
  C:\Windows\System\NdxChXH.exe
  2⤵
  PID:7072
- C:\Windows\System\LowhAic.exe
  C:\Windows\System\LowhAic.exe
  2⤵
  PID:7088
- C:\Windows\System\rTgbnox.exe
  C:\Windows\System\rTgbnox.exe
  2⤵
  PID:7104
- C:\Windows\System\PMhrgVs.exe
  C:\Windows\System\PMhrgVs.exe
  2⤵
  PID:7120
- C:\Windows\System\nmRacWi.exe
  C:\Windows\System\nmRacWi.exe
  2⤵
  PID:7136
- C:\Windows\System\vLdwCtK.exe
  C:\Windows\System\vLdwCtK.exe
  2⤵
  PID:7152
- C:\Windows\System\fjPSXPS.exe
  C:\Windows\System\fjPSXPS.exe
  2⤵
  PID:5476
- C:\Windows\System\vrCbVZh.exe
  C:\Windows\System\vrCbVZh.exe
  2⤵
  PID:6168
- C:\Windows\System\WdcygMo.exe
  C:\Windows\System\WdcygMo.exe
  2⤵
  PID:6148
- C:\Windows\System\jLpayWA.exe
  C:\Windows\System\jLpayWA.exe
  2⤵
  PID:6212
- C:\Windows\System\swvugMX.exe
  C:\Windows\System\swvugMX.exe
  2⤵
  PID:6260
- C:\Windows\System\XeLKCab.exe
  C:\Windows\System\XeLKCab.exe
  2⤵
  PID:6292
- C:\Windows\System\CLOiwXN.exe
  C:\Windows\System\CLOiwXN.exe
  2⤵
  PID:6276
- C:\Windows\System\RcuAETE.exe
  C:\Windows\System\RcuAETE.exe
  2⤵
  PID:6344
- C:\Windows\System\CZEETwo.exe
  C:\Windows\System\CZEETwo.exe
  2⤵
  PID:6388
- C:\Windows\System\jlfKUeM.exe
  C:\Windows\System\jlfKUeM.exe
  2⤵
  PID:6372
- C:\Windows\System\caLTyTZ.exe
  C:\Windows\System\caLTyTZ.exe
  2⤵
  PID:6436
- C:\Windows\System\fZhrgFi.exe
  C:\Windows\System\fZhrgFi.exe
  2⤵
  PID:6488
- C:\Windows\System\YcFbQTD.exe
  C:\Windows\System\YcFbQTD.exe
  2⤵
  PID:6548
- C:\Windows\System\mpjlHjy.exe
  C:\Windows\System\mpjlHjy.exe
  2⤵
  PID:6584
- C:\Windows\System\ZIntnbN.exe
  C:\Windows\System\ZIntnbN.exe
  2⤵
  PID:6564
- C:\Windows\System\YOlNFrt.exe
  C:\Windows\System\YOlNFrt.exe
  2⤵
  PID:6600
- C:\Windows\System\wZiwqKD.exe
  C:\Windows\System\wZiwqKD.exe
  2⤵
  PID:6632
- C:\Windows\System\VgFgEgk.exe
  C:\Windows\System\VgFgEgk.exe
  2⤵
  PID:6660
- C:\Windows\System\EqpgMsv.exe
  C:\Windows\System\EqpgMsv.exe
  2⤵
  PID:6692
- C:\Windows\System\WgIYGJs.exe
  C:\Windows\System\WgIYGJs.exe
  2⤵
  PID:6724
- C:\Windows\System\CZycuxo.exe
  C:\Windows\System\CZycuxo.exe
  2⤵
  PID:6804
- C:\Windows\System\VZGMmoG.exe
  C:\Windows\System\VZGMmoG.exe
  2⤵
  PID:6756
- C:\Windows\System\mIHOsgY.exe
  C:\Windows\System\mIHOsgY.exe
  2⤵
  PID:6836
- C:\Windows\System\WMXMvYS.exe
  C:\Windows\System\WMXMvYS.exe
  2⤵
  PID:6868
- C:\Windows\System\UTODnaS.exe
  C:\Windows\System\UTODnaS.exe
  2⤵
  PID:6904
- C:\Windows\System\VPGmudg.exe
  C:\Windows\System\VPGmudg.exe
  2⤵
  PID:6888
- C:\Windows\System\bRFcSKT.exe
  C:\Windows\System\bRFcSKT.exe
  2⤵
  PID:6952
- C:\Windows\System\YKzFaGS.exe
  C:\Windows\System\YKzFaGS.exe
  2⤵
  PID:7000
- C:\Windows\System\ohElEYg.exe
  C:\Windows\System\ohElEYg.exe
  2⤵
  PID:7020
- C:\Windows\System\hNWwNiQ.exe
  C:\Windows\System\hNWwNiQ.exe
  2⤵
  PID:7048
- C:\Windows\System\blqmiIq.exe
  C:\Windows\System\blqmiIq.exe
  2⤵
  PID:7084
- C:\Windows\System\zXEVmmm.exe
  C:\Windows\System\zXEVmmm.exe
  2⤵
  PID:5984
- C:\Windows\System\cfDwzsl.exe
  C:\Windows\System\cfDwzsl.exe
  2⤵
  PID:7100
- C:\Windows\System\YFgiClx.exe
  C:\Windows\System\YFgiClx.exe
  2⤵
  PID:6232
- C:\Windows\System\bahDPuV.exe
  C:\Windows\System\bahDPuV.exe
  2⤵
  PID:6356
- C:\Windows\System\LEulZhE.exe
  C:\Windows\System\LEulZhE.exe
  2⤵
  PID:6312
- C:\Windows\System\IPYLAlK.exe
  C:\Windows\System\IPYLAlK.exe
  2⤵
  PID:6580
- C:\Windows\System\IGMmGos.exe
  C:\Windows\System\IGMmGos.exe
  2⤵
  PID:6532
- C:\Windows\System\KGELksW.exe
  C:\Windows\System\KGELksW.exe
  2⤵
  PID:6696
- C:\Windows\System\TStmSxI.exe
  C:\Windows\System\TStmSxI.exe
  2⤵
  PID:6596
- C:\Windows\System\lvpdBth.exe
  C:\Windows\System\lvpdBth.exe
  2⤵
  PID:6612
- C:\Windows\System\hpDsYEB.exe
  C:\Windows\System\hpDsYEB.exe
  2⤵
  PID:6988
- C:\Windows\System\tFAKjeQ.exe
  C:\Windows\System\tFAKjeQ.exe
  2⤵
  PID:6680
- C:\Windows\System\MYFHDNg.exe
  C:\Windows\System\MYFHDNg.exe
  2⤵
  PID:6820
- C:\Windows\System\iLCCXJC.exe
  C:\Windows\System\iLCCXJC.exe
  2⤵
  PID:5756
- C:\Windows\System\XLSBBOf.exe
  C:\Windows\System\XLSBBOf.exe
  2⤵
  PID:7036
- C:\Windows\System\xRsmRuM.exe
  C:\Windows\System\xRsmRuM.exe
  2⤵
  PID:7112
- C:\Windows\System\nZhoxwE.exe
  C:\Windows\System\nZhoxwE.exe
  2⤵
  PID:7132
- C:\Windows\System\UYzFGtr.exe
  C:\Windows\System\UYzFGtr.exe
  2⤵
  PID:6200
- C:\Windows\System\ievGXAs.exe
  C:\Windows\System\ievGXAs.exe
  2⤵
  PID:6324
- C:\Windows\System\GHNuiiH.exe
  C:\Windows\System\GHNuiiH.exe
  2⤵
  PID:6472
- C:\Windows\System\MqQrBZB.exe
  C:\Windows\System\MqQrBZB.exe
  2⤵
  PID:6772
- C:\Windows\System\tVxwprE.exe
  C:\Windows\System\tVxwprE.exe
  2⤵
  PID:6920
- C:\Windows\System\TdZCxrN.exe
  C:\Windows\System\TdZCxrN.exe
  2⤵
  PID:6184
- C:\Windows\System\XYZeROR.exe
  C:\Windows\System\XYZeROR.exe
  2⤵
  PID:7068
- C:\Windows\System\HckKqlQ.exe
  C:\Windows\System\HckKqlQ.exe
  2⤵
  PID:6792
- C:\Windows\System\xFLxROr.exe
  C:\Windows\System\xFLxROr.exe
  2⤵
  PID:6408
- C:\Windows\System\ihJFHFt.exe
  C:\Windows\System\ihJFHFt.exe
  2⤵
  PID:6424
- C:\Windows\System\LNhdTeD.exe
  C:\Windows\System\LNhdTeD.exe
  2⤵
  PID:7164
- C:\Windows\System\upAifrk.exe
  C:\Windows\System\upAifrk.exe
  2⤵
  PID:6776
- C:\Windows\System\dEloBCS.exe
  C:\Windows\System\dEloBCS.exe
  2⤵
  PID:6484
- C:\Windows\System\FXuCikh.exe
  C:\Windows\System\FXuCikh.exe
  2⤵
  PID:6628
- C:\Windows\System\ENPOKtp.exe
  C:\Windows\System\ENPOKtp.exe
  2⤵
  PID:7180
- C:\Windows\System\WjeWTYa.exe
  C:\Windows\System\WjeWTYa.exe
  2⤵
  PID:7196
- C:\Windows\System\CwooixN.exe
  C:\Windows\System\CwooixN.exe
  2⤵
  PID:7212
- C:\Windows\System\tONbggL.exe
  C:\Windows\System\tONbggL.exe
  2⤵
  PID:7228
- C:\Windows\System\GIuAZuZ.exe
  C:\Windows\System\GIuAZuZ.exe
  2⤵
  PID:7244
- C:\Windows\System\hkmNlTF.exe
  C:\Windows\System\hkmNlTF.exe
  2⤵
  PID:7260
- C:\Windows\System\UvMSyDP.exe
  C:\Windows\System\UvMSyDP.exe
  2⤵
  PID:7276
- C:\Windows\System\ihtaOeZ.exe
  C:\Windows\System\ihtaOeZ.exe
  2⤵
  PID:7292
- C:\Windows\System\MuQkvKH.exe
  C:\Windows\System\MuQkvKH.exe
  2⤵
  PID:7316
- C:\Windows\System\ZizIykH.exe
  C:\Windows\System\ZizIykH.exe
  2⤵
  PID:7332
- C:\Windows\System\pzyPPAd.exe
  C:\Windows\System\pzyPPAd.exe
  2⤵
  PID:7348
- C:\Windows\System\lTtbFxX.exe
  C:\Windows\System\lTtbFxX.exe
  2⤵
  PID:7364
- C:\Windows\System\yjrPfgP.exe
  C:\Windows\System\yjrPfgP.exe
  2⤵
  PID:7380
- C:\Windows\System\YhIVfJH.exe
  C:\Windows\System\YhIVfJH.exe
  2⤵
  PID:7404
- C:\Windows\System\apivodT.exe
  C:\Windows\System\apivodT.exe
  2⤵
  PID:7420
- C:\Windows\System\dbNrRvT.exe
  C:\Windows\System\dbNrRvT.exe
  2⤵
  PID:7436
- C:\Windows\System\vFzdfjE.exe
  C:\Windows\System\vFzdfjE.exe
  2⤵
  PID:7452
- C:\Windows\System\HnKIonb.exe
  C:\Windows\System\HnKIonb.exe
  2⤵
  PID:7472
- C:\Windows\System\kxwTIfd.exe
  C:\Windows\System\kxwTIfd.exe
  2⤵
  PID:7488
- C:\Windows\System\VAGxUdD.exe
  C:\Windows\System\VAGxUdD.exe
  2⤵
  PID:7512
- C:\Windows\System\McrgIRX.exe
  C:\Windows\System\McrgIRX.exe
  2⤵
  PID:7532
- C:\Windows\System\aIMlGSa.exe
  C:\Windows\System\aIMlGSa.exe
  2⤵
  PID:7548
- C:\Windows\System\pDqmxzK.exe
  C:\Windows\System\pDqmxzK.exe
  2⤵
  PID:7564
- C:\Windows\System\tvgNlMG.exe
  C:\Windows\System\tvgNlMG.exe
  2⤵
  PID:7580
- C:\Windows\System\POTNUGf.exe
  C:\Windows\System\POTNUGf.exe
  2⤵
  PID:7596
- C:\Windows\System\CoWKtpl.exe
  C:\Windows\System\CoWKtpl.exe
  2⤵
  PID:7612
- C:\Windows\System\injWUnt.exe
  C:\Windows\System\injWUnt.exe
  2⤵
  PID:7628
- C:\Windows\System\oGtfalE.exe
  C:\Windows\System\oGtfalE.exe
  2⤵
  PID:7644
- C:\Windows\System\GCXWSvV.exe
  C:\Windows\System\GCXWSvV.exe
  2⤵
  PID:7660
- C:\Windows\System\lttbACx.exe
  C:\Windows\System\lttbACx.exe
  2⤵
  PID:7676
- C:\Windows\System\oEniFII.exe
  C:\Windows\System\oEniFII.exe
  2⤵
  PID:7692
- C:\Windows\System\IUUbdjI.exe
  C:\Windows\System\IUUbdjI.exe
  2⤵
  PID:7708
- C:\Windows\System\sttMIIu.exe
  C:\Windows\System\sttMIIu.exe
  2⤵
  PID:7724
- C:\Windows\System\fjfLtnE.exe
  C:\Windows\System\fjfLtnE.exe
  2⤵
  PID:7740
- C:\Windows\System\KzwbmSk.exe
  C:\Windows\System\KzwbmSk.exe
  2⤵
  PID:7760
- C:\Windows\System\VJxOkXy.exe
  C:\Windows\System\VJxOkXy.exe
  2⤵
  PID:7776
- C:\Windows\System\ZoerVRv.exe
  C:\Windows\System\ZoerVRv.exe
  2⤵
  PID:7792
- C:\Windows\System\ZFvuZTe.exe
  C:\Windows\System\ZFvuZTe.exe
  2⤵
  PID:7808
- C:\Windows\System\weBZCpY.exe
  C:\Windows\System\weBZCpY.exe
  2⤵
  PID:7828
- C:\Windows\System\OsNXOFG.exe
  C:\Windows\System\OsNXOFG.exe
  2⤵
  PID:7848
- C:\Windows\System\HzxNyuj.exe
  C:\Windows\System\HzxNyuj.exe
  2⤵
  PID:7864
- C:\Windows\System\uvWoBGE.exe
  C:\Windows\System\uvWoBGE.exe
  2⤵
  PID:7880
- C:\Windows\System\ZuvTLOc.exe
  C:\Windows\System\ZuvTLOc.exe
  2⤵
  PID:7896
- C:\Windows\System\EjNzSUW.exe
  C:\Windows\System\EjNzSUW.exe
  2⤵
  PID:7912
- C:\Windows\System\coxdeJF.exe
  C:\Windows\System\coxdeJF.exe
  2⤵
  PID:7928
- C:\Windows\System\jIeWJsM.exe
  C:\Windows\System\jIeWJsM.exe
  2⤵
  PID:7944
- C:\Windows\System\ZiarPVx.exe
  C:\Windows\System\ZiarPVx.exe
  2⤵
  PID:7964
- C:\Windows\System\AFWTtfe.exe
  C:\Windows\System\AFWTtfe.exe
  2⤵
  PID:7980
- C:\Windows\System\TWYpybU.exe
  C:\Windows\System\TWYpybU.exe
  2⤵
  PID:7996
- C:\Windows\System\zbwqjep.exe
  C:\Windows\System\zbwqjep.exe
  2⤵
  PID:8012
- C:\Windows\System\rrdmUOF.exe
  C:\Windows\System\rrdmUOF.exe
  2⤵
  PID:8028
- C:\Windows\System\FcPcCIC.exe
  C:\Windows\System\FcPcCIC.exe
  2⤵
  PID:8044
- C:\Windows\System\RInkaQY.exe
  C:\Windows\System\RInkaQY.exe
  2⤵
  PID:8060
- C:\Windows\System\BuIiyzh.exe
  C:\Windows\System\BuIiyzh.exe
  2⤵
  PID:8076
- C:\Windows\System\IWJcZWA.exe
  C:\Windows\System\IWJcZWA.exe
  2⤵
  PID:8092
- C:\Windows\System\OOPNIOu.exe
  C:\Windows\System\OOPNIOu.exe
  2⤵
  PID:8108
- C:\Windows\System\NbIhJnb.exe
  C:\Windows\System\NbIhJnb.exe
  2⤵
  PID:8124
- C:\Windows\System\nTaBshf.exe
  C:\Windows\System\nTaBshf.exe
  2⤵
  PID:8144
- C:\Windows\System\tlxklxF.exe
  C:\Windows\System\tlxklxF.exe
  2⤵
  PID:8164
- C:\Windows\System\mwMoJih.exe
  C:\Windows\System\mwMoJih.exe
  2⤵
  PID:8180
- C:\Windows\System\DLPzGkU.exe
  C:\Windows\System\DLPzGkU.exe
  2⤵
  PID:7080
- C:\Windows\System\JidYcmv.exe
  C:\Windows\System\JidYcmv.exe
  2⤵
  PID:7208
- C:\Windows\System\TlqJZZy.exe
  C:\Windows\System\TlqJZZy.exe
  2⤵
  PID:7268
- C:\Windows\System\aXdkwPH.exe
  C:\Windows\System\aXdkwPH.exe
  2⤵
  PID:7300
- C:\Windows\System\RATSpqb.exe
  C:\Windows\System\RATSpqb.exe
  2⤵
  PID:6884
- C:\Windows\System\bsyHcuv.exe
  C:\Windows\System\bsyHcuv.exe
  2⤵
  PID:7148
- C:\Windows\System\EWJtZXw.exe
  C:\Windows\System\EWJtZXw.exe
  2⤵
  PID:7284
- C:\Windows\System\fMxcChX.exe
  C:\Windows\System\fMxcChX.exe
  2⤵
  PID:7340
- C:\Windows\System\sWSNWJr.exe
  C:\Windows\System\sWSNWJr.exe
  2⤵
  PID:7324
- C:\Windows\System\vUgoCKM.exe
  C:\Windows\System\vUgoCKM.exe
  2⤵
  PID:7396
- C:\Windows\System\gFyaNjL.exe
  C:\Windows\System\gFyaNjL.exe
  2⤵
  PID:7388
- C:\Windows\System\EaSAyff.exe
  C:\Windows\System\EaSAyff.exe
  2⤵
  PID:7432
- C:\Windows\System\atTutwz.exe
  C:\Windows\System\atTutwz.exe
  2⤵
  PID:7520
- C:\Windows\System\zSIXxhk.exe
  C:\Windows\System\zSIXxhk.exe
  2⤵
  PID:7560
- C:\Windows\System\OneBeAD.exe
  C:\Windows\System\OneBeAD.exe
  2⤵
  PID:7652
- C:\Windows\System\QpMochy.exe
  C:\Windows\System\QpMochy.exe
  2⤵
  PID:7544
- C:\Windows\System\qDNCssm.exe
  C:\Windows\System\qDNCssm.exe
  2⤵
  PID:7748
- C:\Windows\System\Jvrhgqb.exe
  C:\Windows\System\Jvrhgqb.exe
  2⤵
  PID:7464
- C:\Windows\System\oiUQDlx.exe
  C:\Windows\System\oiUQDlx.exe
  2⤵
  PID:7496
- C:\Windows\System\IeHgHKB.exe
  C:\Windows\System\IeHgHKB.exe
  2⤵
  PID:7608
- C:\Windows\System\pYQWCRx.exe
  C:\Windows\System\pYQWCRx.exe
  2⤵
  PID:7672
- C:\Windows\System\YiSOIkK.exe
  C:\Windows\System\YiSOIkK.exe
  2⤵
  PID:7736
- C:\Windows\System\mKGGeLj.exe
  C:\Windows\System\mKGGeLj.exe
  2⤵
  PID:7804
- C:\Windows\System\OJBrORl.exe
  C:\Windows\System\OJBrORl.exe
  2⤵
  PID:7824
- C:\Windows\System\bsgqlSE.exe
  C:\Windows\System\bsgqlSE.exe
  2⤵
  PID:7836
- C:\Windows\System\nPhXtsT.exe
  C:\Windows\System\nPhXtsT.exe
  2⤵
  PID:7920
- C:\Windows\System\UkHsunT.exe
  C:\Windows\System\UkHsunT.exe
  2⤵
  PID:7904
- C:\Windows\System\bWGhBHg.exe
  C:\Windows\System\bWGhBHg.exe
  2⤵
  PID:7956
- C:\Windows\System\vTEguyE.exe
  C:\Windows\System\vTEguyE.exe
  2⤵
  PID:7940
- C:\Windows\System\dGwfftV.exe
  C:\Windows\System\dGwfftV.exe
  2⤵
  PID:8004
- C:\Windows\System\ikrhSFC.exe
  C:\Windows\System\ikrhSFC.exe
  2⤵
  PID:8052
- C:\Windows\System\EBVMZrC.exe
  C:\Windows\System\EBVMZrC.exe
  2⤵
  PID:8056
- C:\Windows\System\vBjXzbY.exe
  C:\Windows\System\vBjXzbY.exe
  2⤵
  PID:8160
- C:\Windows\System\abxGgLw.exe
  C:\Windows\System\abxGgLw.exe
  2⤵
  PID:6536
- C:\Windows\System\bPLwoWr.exe
  C:\Windows\System\bPLwoWr.exe
  2⤵
  PID:8072
- C:\Windows\System\qxGgFkg.exe
  C:\Windows\System\qxGgFkg.exe
  2⤵
  PID:7220
- C:\Windows\System\ajVjUFi.exe
  C:\Windows\System\ajVjUFi.exe
  2⤵
  PID:7256
- C:\Windows\System\eVNLQzv.exe
  C:\Windows\System\eVNLQzv.exe
  2⤵
  PID:7272
- C:\Windows\System\fRUpJAU.exe
  C:\Windows\System\fRUpJAU.exe
  2⤵
  PID:7344
- C:\Windows\System\JiYXRzj.exe
  C:\Windows\System\JiYXRzj.exe
  2⤵
  PID:7480
- C:\Windows\System\GVyFezd.exe
  C:\Windows\System\GVyFezd.exe
  2⤵
  PID:7624
- C:\Windows\System\aVGEPzq.exe
  C:\Windows\System\aVGEPzq.exe
  2⤵
  PID:7540
- C:\Windows\System\cUInDWw.exe
  C:\Windows\System\cUInDWw.exe
  2⤵
  PID:7784
- C:\Windows\System\XLGrGVM.exe
  C:\Windows\System\XLGrGVM.exe
  2⤵
  PID:7800
- C:\Windows\System\jkOEniz.exe
  C:\Windows\System\jkOEniz.exe
  2⤵
  PID:7756
- C:\Windows\System\jiWYEfi.exe
  C:\Windows\System\jiWYEfi.exe
  2⤵
  PID:7604
- C:\Windows\System\rHtMFUN.exe
  C:\Windows\System\rHtMFUN.exe
  2⤵
  PID:7816
- C:\Windows\System\CoozypK.exe
  C:\Windows\System\CoozypK.exe
  2⤵
  PID:8152
- C:\Windows\System\gAWnAfD.exe
  C:\Windows\System\gAWnAfD.exe
  2⤵
  PID:8040
- C:\Windows\System\iVYWBEH.exe
  C:\Windows\System\iVYWBEH.exe
  2⤵
  PID:8120
- C:\Windows\System\FNCEwzf.exe
  C:\Windows\System\FNCEwzf.exe
  2⤵
  PID:7176
- C:\Windows\System\DdpGtQz.exe
  C:\Windows\System\DdpGtQz.exe
  2⤵
  PID:7204
- C:\Windows\System\pVdEWWX.exe
  C:\Windows\System\pVdEWWX.exe
  2⤵
  PID:7484
- C:\Windows\System\RiBzoYS.exe
  C:\Windows\System\RiBzoYS.exe
  2⤵
  PID:7668
- C:\Windows\System\ouuemnw.exe
  C:\Windows\System\ouuemnw.exe
  2⤵
  PID:7392
- C:\Windows\System\LaAKTeD.exe
  C:\Windows\System\LaAKTeD.exe
  2⤵
  PID:7400
- C:\Windows\System\OTUgLdl.exe
  C:\Windows\System\OTUgLdl.exe
  2⤵
  PID:6456
- C:\Windows\System\tBuCuaX.exe
  C:\Windows\System\tBuCuaX.exe
  2⤵
  PID:7992
- C:\Windows\System\vnzFLaP.exe
  C:\Windows\System\vnzFLaP.exe
  2⤵
  PID:7936
- C:\Windows\System\bcJWruk.exe
  C:\Windows\System\bcJWruk.exe
  2⤵
  PID:7972
- C:\Windows\System\Yynlulk.exe
  C:\Windows\System\Yynlulk.exe
  2⤵
  PID:8176
- C:\Windows\System\EkLvCcc.exe
  C:\Windows\System\EkLvCcc.exe
  2⤵
  PID:7684
- C:\Windows\System\uAXtEBA.exe
  C:\Windows\System\uAXtEBA.exe
  2⤵
  PID:7620
- C:\Windows\System\mmRYgYZ.exe
  C:\Windows\System\mmRYgYZ.exe
  2⤵
  PID:7924
- C:\Windows\System\SHNkVCC.exe
  C:\Windows\System\SHNkVCC.exe
  2⤵
  PID:7892
- C:\Windows\System\kWTzDGt.exe
  C:\Windows\System\kWTzDGt.exe
  2⤵
  PID:8068
- C:\Windows\System\FyBDblk.exe
  C:\Windows\System\FyBDblk.exe
  2⤵
  PID:7720
- C:\Windows\System\AIIUPya.exe
  C:\Windows\System\AIIUPya.exe
  2⤵
  PID:8200
- C:\Windows\System\GnrfyNY.exe
  C:\Windows\System\GnrfyNY.exe
  2⤵
  PID:8216
- C:\Windows\System\XeKatgl.exe
  C:\Windows\System\XeKatgl.exe
  2⤵
  PID:8232
- C:\Windows\System\bmlIAYE.exe
  C:\Windows\System\bmlIAYE.exe
  2⤵
  PID:8248
- C:\Windows\System\GWTNOMw.exe
  C:\Windows\System\GWTNOMw.exe
  2⤵
  PID:8264
- C:\Windows\System\ApWZgft.exe
  C:\Windows\System\ApWZgft.exe
  2⤵
  PID:8280
- C:\Windows\System\gUnstmC.exe
  C:\Windows\System\gUnstmC.exe
  2⤵
  PID:8296
- C:\Windows\System\IjZTvBp.exe
  C:\Windows\System\IjZTvBp.exe
  2⤵
  PID:8336
- C:\Windows\System\XAndTTu.exe
  C:\Windows\System\XAndTTu.exe
  2⤵
  PID:8368
- C:\Windows\System\RIrJRXX.exe
  C:\Windows\System\RIrJRXX.exe
  2⤵
  PID:8384
- C:\Windows\System\zvEVgCi.exe
  C:\Windows\System\zvEVgCi.exe
  2⤵
  PID:8400
- C:\Windows\System\hRplubj.exe
  C:\Windows\System\hRplubj.exe
  2⤵
  PID:8416
- C:\Windows\System\vinLlTg.exe
  C:\Windows\System\vinLlTg.exe
  2⤵
  PID:8432
- C:\Windows\System\grXHoUy.exe
  C:\Windows\System\grXHoUy.exe
  2⤵
  PID:8448
- C:\Windows\System\ySfBsFW.exe
  C:\Windows\System\ySfBsFW.exe
  2⤵
  PID:8464
- C:\Windows\System\WHHlvJf.exe
  C:\Windows\System\WHHlvJf.exe
  2⤵
  PID:8480
- C:\Windows\System\ULsfmhs.exe
  C:\Windows\System\ULsfmhs.exe
  2⤵
  PID:8496
- C:\Windows\System\bIhrjly.exe
  C:\Windows\System\bIhrjly.exe
  2⤵
  PID:8512
- C:\Windows\System\PetiLri.exe
  C:\Windows\System\PetiLri.exe
  2⤵
  PID:8528
- C:\Windows\System\iIyCgMn.exe
  C:\Windows\System\iIyCgMn.exe
  2⤵
  PID:8544
- C:\Windows\System\WphhLOd.exe
  C:\Windows\System\WphhLOd.exe
  2⤵
  PID:8560
- C:\Windows\System\TNtcFDy.exe
  C:\Windows\System\TNtcFDy.exe
  2⤵
  PID:8576
- C:\Windows\System\ASshZQf.exe
  C:\Windows\System\ASshZQf.exe
  2⤵
  PID:8592
- C:\Windows\System\IoqjZEf.exe
  C:\Windows\System\IoqjZEf.exe
  2⤵
  PID:8608
- C:\Windows\System\zbvMEib.exe
  C:\Windows\System\zbvMEib.exe
  2⤵
  PID:8624
- C:\Windows\System\MUKknHN.exe
  C:\Windows\System\MUKknHN.exe
  2⤵
  PID:8640
- C:\Windows\System\liAaZsm.exe
  C:\Windows\System\liAaZsm.exe
  2⤵
  PID:8656
- C:\Windows\System\JjaCEGH.exe
  C:\Windows\System\JjaCEGH.exe
  2⤵
  PID:8672
- C:\Windows\System\kfOveuT.exe
  C:\Windows\System\kfOveuT.exe
  2⤵
  PID:8688
- C:\Windows\System\zRbTUvR.exe
  C:\Windows\System\zRbTUvR.exe
  2⤵
  PID:8704
- C:\Windows\System\buuFOri.exe
  C:\Windows\System\buuFOri.exe
  2⤵
  PID:8720
- C:\Windows\System\ItYrhGV.exe
  C:\Windows\System\ItYrhGV.exe
  2⤵
  PID:8740
- C:\Windows\System\hvaEddK.exe
  C:\Windows\System\hvaEddK.exe
  2⤵
  PID:8756
- C:\Windows\System\PKKrrhF.exe
  C:\Windows\System\PKKrrhF.exe
  2⤵
  PID:8772
- C:\Windows\System\zMmhPmU.exe
  C:\Windows\System\zMmhPmU.exe
  2⤵
  PID:8788
- C:\Windows\System\pIshwFV.exe
  C:\Windows\System\pIshwFV.exe
  2⤵
  PID:8804
- C:\Windows\System\qJMVQMC.exe
  C:\Windows\System\qJMVQMC.exe
  2⤵
  PID:8820
- C:\Windows\System\pWxqkws.exe
  C:\Windows\System\pWxqkws.exe
  2⤵
  PID:8840
- C:\Windows\System\oxaOXYu.exe
  C:\Windows\System\oxaOXYu.exe
  2⤵
  PID:8856
- C:\Windows\System\wNvHhZt.exe
  C:\Windows\System\wNvHhZt.exe
  2⤵
  PID:8872
- C:\Windows\System\mVJJfVg.exe
  C:\Windows\System\mVJJfVg.exe
  2⤵
  PID:8888
- C:\Windows\System\YlUHSwf.exe
  C:\Windows\System\YlUHSwf.exe
  2⤵
  PID:8904
- C:\Windows\System\SlenPzI.exe
  C:\Windows\System\SlenPzI.exe
  2⤵
  PID:8920
- C:\Windows\System\fGWLnZX.exe
  C:\Windows\System\fGWLnZX.exe
  2⤵
  PID:8936
- C:\Windows\System\NJZrgIW.exe
  C:\Windows\System\NJZrgIW.exe
  2⤵
  PID:8952
- C:\Windows\System\LONcrha.exe
  C:\Windows\System\LONcrha.exe
  2⤵
  PID:8972
- C:\Windows\System\FZXiIdy.exe
  C:\Windows\System\FZXiIdy.exe
  2⤵
  PID:8988
- C:\Windows\System\NPIZIzo.exe
  C:\Windows\System\NPIZIzo.exe
  2⤵
  PID:9004
- C:\Windows\System\pDnlhEN.exe
  C:\Windows\System\pDnlhEN.exe
  2⤵
  PID:9024
- C:\Windows\System\bVUnoTm.exe
  C:\Windows\System\bVUnoTm.exe
  2⤵
  PID:9040
- C:\Windows\System\JXmqRal.exe
  C:\Windows\System\JXmqRal.exe
  2⤵
  PID:9056
- C:\Windows\System\foCMojk.exe
  C:\Windows\System\foCMojk.exe
  2⤵
  PID:9072
- C:\Windows\System\aoWByuH.exe
  C:\Windows\System\aoWByuH.exe
  2⤵
  PID:9108
- C:\Windows\System\avAikFA.exe
  C:\Windows\System\avAikFA.exe
  2⤵
  PID:9124
- C:\Windows\System\ywNDzyN.exe
  C:\Windows\System\ywNDzyN.exe
  2⤵
  PID:9140
- C:\Windows\System\ePWvrct.exe
  C:\Windows\System\ePWvrct.exe
  2⤵
  PID:9156
- C:\Windows\System\SfBuPgj.exe
  C:\Windows\System\SfBuPgj.exe
  2⤵
  PID:9172
- C:\Windows\System\zBMqxVY.exe
  C:\Windows\System\zBMqxVY.exe
  2⤵
  PID:9188
- C:\Windows\System\cLLXAIZ.exe
  C:\Windows\System\cLLXAIZ.exe
  2⤵
  PID:9212
- C:\Windows\System\azsScnA.exe
  C:\Windows\System\azsScnA.exe
  2⤵
  PID:8304
- C:\Windows\System\NUPQqIg.exe
  C:\Windows\System\NUPQqIg.exe
  2⤵
  PID:7640
- C:\Windows\System\SEnTAox.exe
  C:\Windows\System\SEnTAox.exe
  2⤵
  PID:8228
- C:\Windows\System\vqCHckK.exe
  C:\Windows\System\vqCHckK.exe
  2⤵
  PID:8196
- C:\Windows\System\TSxebrm.exe
  C:\Windows\System\TSxebrm.exe
  2⤵
  PID:8288
- C:\Windows\System\VHzTtZK.exe
  C:\Windows\System\VHzTtZK.exe
  2⤵
  PID:8344
- C:\Windows\System\oNZNCFg.exe
  C:\Windows\System\oNZNCFg.exe
  2⤵
  PID:8364
- C:\Windows\System\xfsESOA.exe
  C:\Windows\System\xfsESOA.exe
  2⤵
  PID:8356
- C:\Windows\System\FMUeLdG.exe
  C:\Windows\System\FMUeLdG.exe
  2⤵
  PID:8444
- C:\Windows\System\ccFvTMf.exe
  C:\Windows\System\ccFvTMf.exe
  2⤵
  PID:8508
- C:\Windows\System\ONNnFUd.exe
  C:\Windows\System\ONNnFUd.exe
  2⤵
  PID:8460
- C:\Windows\System\WAzlyoT.exe
  C:\Windows\System\WAzlyoT.exe
  2⤵
  PID:8540
- C:\Windows\System\FkWFCVv.exe
  C:\Windows\System\FkWFCVv.exe
  2⤵
  PID:8632
- C:\Windows\System\ZEOFveb.exe
  C:\Windows\System\ZEOFveb.exe
  2⤵
  PID:8552
- C:\Windows\System\HrMtLDC.exe
  C:\Windows\System\HrMtLDC.exe
  2⤵
  PID:8616
- C:\Windows\System\dSXpXOl.exe
  C:\Windows\System\dSXpXOl.exe
  2⤵
  PID:8712
- C:\Windows\System\ewggSVL.exe
  C:\Windows\System\ewggSVL.exe
  2⤵
  PID:8748
- C:\Windows\System\OzIdEzk.exe
  C:\Windows\System\OzIdEzk.exe
  2⤵
  PID:8768
- C:\Windows\System\IaAflIY.exe
  C:\Windows\System\IaAflIY.exe
  2⤵
  PID:8812
- C:\Windows\System\rbhpqBQ.exe
  C:\Windows\System\rbhpqBQ.exe
  2⤵
  PID:8828
- C:\Windows\System\oPXTmoD.exe
  C:\Windows\System\oPXTmoD.exe
  2⤵
  PID:8864
- C:\Windows\System\WVQEYTh.exe
  C:\Windows\System\WVQEYTh.exe
  2⤵
  PID:8900
- C:\Windows\System\azkBevG.exe
  C:\Windows\System\azkBevG.exe
  2⤵
  PID:8848
- C:\Windows\System\sXfQiHH.exe
  C:\Windows\System\sXfQiHH.exe
  2⤵
  PID:8912
- C:\Windows\System\EpKCeEk.exe
  C:\Windows\System\EpKCeEk.exe
  2⤵
  PID:9036
- C:\Windows\System\joWsFcp.exe
  C:\Windows\System\joWsFcp.exe
  2⤵
  PID:9116
- C:\Windows\System\yUUUijG.exe
  C:\Windows\System\yUUUijG.exe
  2⤵
  PID:9020
- C:\Windows\System\dBzAAFu.exe
  C:\Windows\System\dBzAAFu.exe
  2⤵
  PID:9180
- C:\Windows\System\jhdfynv.exe
  C:\Windows\System\jhdfynv.exe
  2⤵
  PID:9048
- C:\Windows\System\htDBIhu.exe
  C:\Windows\System\htDBIhu.exe
  2⤵
  PID:9196
- C:\Windows\System\YcBtRqY.exe
  C:\Windows\System\YcBtRqY.exe
  2⤵
  PID:8272
- C:\Windows\System\sDEozjA.exe
  C:\Windows\System\sDEozjA.exe
  2⤵
  PID:8308
- C:\Windows\System\BkEheOS.exe
  C:\Windows\System\BkEheOS.exe
  2⤵
  PID:8256
- C:\Windows\System\XVwBNTk.exe
  C:\Windows\System\XVwBNTk.exe
  2⤵
  PID:7952
- C:\Windows\System\ALpGhyX.exe
  C:\Windows\System\ALpGhyX.exe
  2⤵
  PID:8316
- C:\Windows\System\gMopiLW.exe
  C:\Windows\System\gMopiLW.exe
  2⤵
  PID:8476
- C:\Windows\System\QTnKUzf.exe
  C:\Windows\System\QTnKUzf.exe
  2⤵
  PID:8568
- C:\Windows\System\rzyKCZI.exe
  C:\Windows\System\rzyKCZI.exe
  2⤵
  PID:8424
- C:\Windows\System\AcYTnZu.exe
  C:\Windows\System\AcYTnZu.exe
  2⤵
  PID:8600
- C:\Windows\System\xyKDPal.exe
  C:\Windows\System\xyKDPal.exe
  2⤵
  PID:8780
- C:\Windows\System\iseUrNr.exe
  C:\Windows\System\iseUrNr.exe
  2⤵
  PID:8488
- C:\Windows\System\GxpDhPd.exe
  C:\Windows\System\GxpDhPd.exe
  2⤵
  PID:8716
- C:\Windows\System\OaAJByZ.exe
  C:\Windows\System\OaAJByZ.exe
  2⤵
  PID:8348
- C:\Windows\System\KFOJdLV.exe
  C:\Windows\System\KFOJdLV.exe
  2⤵
  PID:9148
- C:\Windows\System\RrgbKFs.exe
  C:\Windows\System\RrgbKFs.exe
  2⤵
  PID:8800
- C:\Windows\System\WEMOMIm.exe
  C:\Windows\System\WEMOMIm.exe
  2⤵
  PID:8932
- C:\Windows\System\wpkXnMZ.exe
  C:\Windows\System\wpkXnMZ.exe
  2⤵
  PID:9064
- C:\Windows\System\oPdgSfL.exe
  C:\Windows\System\oPdgSfL.exe
  2⤵
  PID:9200
- C:\Windows\System\tyWuxdO.exe
  C:\Windows\System\tyWuxdO.exe
  2⤵
  PID:8320
- C:\Windows\System\MyCoRQw.exe
  C:\Windows\System\MyCoRQw.exe
  2⤵
  PID:7976
- C:\Windows\System\QBrriGd.exe
  C:\Windows\System\QBrriGd.exe
  2⤵
  PID:8520
- C:\Windows\System\gJPbttb.exe
  C:\Windows\System\gJPbttb.exe
  2⤵
  PID:8964
- C:\Windows\System\iJOnZEg.exe
  C:\Windows\System\iJOnZEg.exe
  2⤵
  PID:8880
- C:\Windows\System\AeRKuBY.exe
  C:\Windows\System\AeRKuBY.exe
  2⤵
  PID:8244
- C:\Windows\System\mgnjoBn.exe
  C:\Windows\System\mgnjoBn.exe
  2⤵
  PID:8680
- C:\Windows\System\fmGwyPd.exe
  C:\Windows\System\fmGwyPd.exe
  2⤵
  PID:9228
- C:\Windows\System\kDtxrOm.exe
  C:\Windows\System\kDtxrOm.exe
  2⤵
  PID:9244
- C:\Windows\System\VNOIbQv.exe
  C:\Windows\System\VNOIbQv.exe
  2⤵
  PID:9260
- C:\Windows\System\rtHwYJM.exe
  C:\Windows\System\rtHwYJM.exe
  2⤵
  PID:9276
- C:\Windows\System\fSpgTci.exe
  C:\Windows\System\fSpgTci.exe
  2⤵
  PID:9292
- C:\Windows\System\qwWhpYJ.exe
  C:\Windows\System\qwWhpYJ.exe
  2⤵
  PID:9308
- C:\Windows\System\QxJxznk.exe
  C:\Windows\System\QxJxznk.exe
  2⤵
  PID:9324
- C:\Windows\System\lDGHbDr.exe
  C:\Windows\System\lDGHbDr.exe
  2⤵
  PID:9340
- C:\Windows\System\uPvvKzI.exe
  C:\Windows\System\uPvvKzI.exe
  2⤵
  PID:9356
- C:\Windows\System\LpgMcGd.exe
  C:\Windows\System\LpgMcGd.exe
  2⤵
  PID:9372
- C:\Windows\System\xuRWSCS.exe
  C:\Windows\System\xuRWSCS.exe
  2⤵
  PID:9388
- C:\Windows\System\RavRHCV.exe
  C:\Windows\System\RavRHCV.exe
  2⤵
  PID:9404
- C:\Windows\System\CezbjwL.exe
  C:\Windows\System\CezbjwL.exe
  2⤵
  PID:9420
- C:\Windows\System\hmeeRzf.exe
  C:\Windows\System\hmeeRzf.exe
  2⤵
  PID:9436
- C:\Windows\System\UoIRTrM.exe
  C:\Windows\System\UoIRTrM.exe
  2⤵
  PID:9452
- C:\Windows\System\VLInPeg.exe
  C:\Windows\System\VLInPeg.exe
  2⤵
  PID:9468
- C:\Windows\System\RVStEzc.exe
  C:\Windows\System\RVStEzc.exe
  2⤵
  PID:9484
- C:\Windows\System\cISKryJ.exe
  C:\Windows\System\cISKryJ.exe
  2⤵
  PID:9500
- C:\Windows\System\nBFqbxd.exe
  C:\Windows\System\nBFqbxd.exe
  2⤵
  PID:9516
- C:\Windows\System\uMOQXtz.exe
  C:\Windows\System\uMOQXtz.exe
  2⤵
  PID:9532
- C:\Windows\System\UzEHtsY.exe
  C:\Windows\System\UzEHtsY.exe
  2⤵
  PID:9548
- C:\Windows\System\ZRnbAmD.exe
  C:\Windows\System\ZRnbAmD.exe
  2⤵
  PID:9564
- C:\Windows\System\husbcmJ.exe
  C:\Windows\System\husbcmJ.exe
  2⤵
  PID:9580
- C:\Windows\System\GhiZDNE.exe
  C:\Windows\System\GhiZDNE.exe
  2⤵
  PID:9600
- C:\Windows\System\aiWsjmV.exe
  C:\Windows\System\aiWsjmV.exe
  2⤵
  PID:9616
- C:\Windows\System\BpqtKkJ.exe
  C:\Windows\System\BpqtKkJ.exe
  2⤵
  PID:9644
- C:\Windows\System\BTKdKgY.exe
  C:\Windows\System\BTKdKgY.exe
  2⤵
  PID:9660
- C:\Windows\System\qmUVCDC.exe
  C:\Windows\System\qmUVCDC.exe
  2⤵
  PID:9676
- C:\Windows\System\olgLNMd.exe
  C:\Windows\System\olgLNMd.exe
  2⤵
  PID:9692
- C:\Windows\System\eiNGukv.exe
  C:\Windows\System\eiNGukv.exe
  2⤵
  PID:9712
- C:\Windows\System\vuvBLVy.exe
  C:\Windows\System\vuvBLVy.exe
  2⤵
  PID:9728
- C:\Windows\System\omgPjmR.exe
  C:\Windows\System\omgPjmR.exe
  2⤵
  PID:9776
- C:\Windows\System\XfJauKS.exe
  C:\Windows\System\XfJauKS.exe
  2⤵
  PID:9792
- C:\Windows\System\crRkZLe.exe
  C:\Windows\System\crRkZLe.exe
  2⤵
  PID:9808
- C:\Windows\System\HnnAVYA.exe
  C:\Windows\System\HnnAVYA.exe
  2⤵
  PID:9828
- C:\Windows\System\mVvWXra.exe
  C:\Windows\System\mVvWXra.exe
  2⤵
  PID:9844
- C:\Windows\System\KzQjBkg.exe
  C:\Windows\System\KzQjBkg.exe
  2⤵
  PID:9864
- C:\Windows\System\mRCElQJ.exe
  C:\Windows\System\mRCElQJ.exe
  2⤵
  PID:9880
- C:\Windows\System\qtehszT.exe
  C:\Windows\System\qtehszT.exe
  2⤵
  PID:9896
- C:\Windows\System\NciKefn.exe
  C:\Windows\System\NciKefn.exe
  2⤵
  PID:9912
- C:\Windows\System\RujAxaI.exe
  C:\Windows\System\RujAxaI.exe
  2⤵
  PID:9928
- C:\Windows\System\YCOToum.exe
  C:\Windows\System\YCOToum.exe
  2⤵
  PID:9944
- C:\Windows\System\nqvRyKc.exe
  C:\Windows\System\nqvRyKc.exe
  2⤵
  PID:9964
- C:\Windows\System\gavDWSd.exe
  C:\Windows\System\gavDWSd.exe
  2⤵
  PID:9980
- C:\Windows\System\yhDNoOW.exe
  C:\Windows\System\yhDNoOW.exe
  2⤵
  PID:9996
- C:\Windows\System\kFqCRdg.exe
  C:\Windows\System\kFqCRdg.exe
  2⤵
  PID:10016
- C:\Windows\System\XFdDKNc.exe
  C:\Windows\System\XFdDKNc.exe
  2⤵
  PID:10032
- C:\Windows\System\KKTbiEn.exe
  C:\Windows\System\KKTbiEn.exe
  2⤵
  PID:10048
- C:\Windows\System\qAFLOdA.exe
  C:\Windows\System\qAFLOdA.exe
  2⤵
  PID:10080
- C:\Windows\System\IbgyGaf.exe
  C:\Windows\System\IbgyGaf.exe
  2⤵
  PID:10100
- C:\Windows\System\PEvWkjv.exe
  C:\Windows\System\PEvWkjv.exe
  2⤵
  PID:10116
- C:\Windows\System\hXNgzvX.exe
  C:\Windows\System\hXNgzvX.exe
  2⤵
  PID:10132
- C:\Windows\System\kQcpODT.exe
  C:\Windows\System\kQcpODT.exe
  2⤵
  PID:10152
- C:\Windows\System\xXGjxzu.exe
  C:\Windows\System\xXGjxzu.exe
  2⤵
  PID:10172
- C:\Windows\System\RISagzY.exe
  C:\Windows\System\RISagzY.exe
  2⤵
  PID:10188
- C:\Windows\System\VZZTWNH.exe
  C:\Windows\System\VZZTWNH.exe
  2⤵
  PID:10204
- C:\Windows\System\fCqQRDo.exe
  C:\Windows\System\fCqQRDo.exe
  2⤵
  PID:10220
- C:\Windows\System\VjOqrJC.exe
  C:\Windows\System\VjOqrJC.exe
  2⤵
  PID:10236
- C:\Windows\System\bqBefmR.exe
  C:\Windows\System\bqBefmR.exe
  2⤵
  PID:9268
- C:\Windows\System\jSBJBfP.exe
  C:\Windows\System\jSBJBfP.exe
  2⤵
  PID:9332
- C:\Windows\System\vgQwwqw.exe
  C:\Windows\System\vgQwwqw.exe
  2⤵
  PID:9400
- C:\Windows\System\Oviyhbk.exe
  C:\Windows\System\Oviyhbk.exe
  2⤵
  PID:9460
- C:\Windows\System\WbxlKkw.exe
  C:\Windows\System\WbxlKkw.exe
  2⤵
  PID:9524
- C:\Windows\System\dmEEKNs.exe
  C:\Windows\System\dmEEKNs.exe
  2⤵
  PID:9596
- C:\Windows\System\omltEwe.exe
  C:\Windows\System\omltEwe.exe
  2⤵
  PID:9152
- C:\Windows\System\TkEsdGI.exe
  C:\Windows\System\TkEsdGI.exe
  2⤵
  PID:9284
- C:\Windows\System\TuWsfiO.exe
  C:\Windows\System\TuWsfiO.exe
  2⤵
  PID:9480
- C:\Windows\System\bYpPBpR.exe
  C:\Windows\System\bYpPBpR.exe
  2⤵
  PID:8240
- C:\Windows\System\cAfaBka.exe
  C:\Windows\System\cAfaBka.exe
  2⤵
  PID:8412
- C:\Windows\System\pLAQeeO.exe
  C:\Windows\System\pLAQeeO.exe
  2⤵
  PID:8588
- C:\Windows\System\HUEKCJd.exe
  C:\Windows\System\HUEKCJd.exe
  2⤵
  PID:9032
- C:\Windows\System\YplQfiF.exe
  C:\Windows\System\YplQfiF.exe
  2⤵
  PID:8328
- C:\Windows\System\WQVMtFU.exe
  C:\Windows\System\WQVMtFU.exe
  2⤵
  PID:9224
- C:\Windows\System\zorGxEo.exe
  C:\Windows\System\zorGxEo.exe
  2⤵
  PID:9288
- C:\Windows\System\GPBLURQ.exe
  C:\Windows\System\GPBLURQ.exe
  2⤵
  PID:9352
- C:\Windows\System\FPiByvv.exe
  C:\Windows\System\FPiByvv.exe
  2⤵
  PID:9476
- C:\Windows\System\aVkvhhe.exe
  C:\Windows\System\aVkvhhe.exe
  2⤵
  PID:9576
- C:\Windows\System\sBQCdVE.exe
  C:\Windows\System\sBQCdVE.exe
  2⤵
  PID:9656
- C:\Windows\System\NicxqMm.exe
  C:\Windows\System\NicxqMm.exe
  2⤵
  PID:9700
- C:\Windows\System\DIfGDyy.exe
  C:\Windows\System\DIfGDyy.exe
  2⤵
  PID:9740
- C:\Windows\System\zUbEqDl.exe
  C:\Windows\System\zUbEqDl.exe
  2⤵
  PID:9824
- C:\Windows\System\SdDhmmt.exe
  C:\Windows\System\SdDhmmt.exe
  2⤵
  PID:9988
- C:\Windows\System\WaSpZJy.exe
  C:\Windows\System\WaSpZJy.exe
  2⤵
  PID:10056
- C:\Windows\System\UzbAlel.exe
  C:\Windows\System\UzbAlel.exe
  2⤵
  PID:10072
- C:\Windows\System\uajlnVo.exe
  C:\Windows\System\uajlnVo.exe
  2⤵
  PID:10088
- C:\Windows\System\KSuaUVn.exe
  C:\Windows\System\KSuaUVn.exe
  2⤵
  PID:9764
- C:\Windows\System\fVWwNxb.exe
  C:\Windows\System\fVWwNxb.exe
  2⤵
  PID:9876
- C:\Windows\System\dHpGppp.exe
  C:\Windows\System\dHpGppp.exe
  2⤵
  PID:10092
- C:\Windows\System\wcXRSpm.exe
  C:\Windows\System\wcXRSpm.exe
  2⤵
  PID:9560
- C:\Windows\System\WsGlLKr.exe
  C:\Windows\System\WsGlLKr.exe
  2⤵
  PID:10200
- C:\Windows\System\QXOBBnL.exe
  C:\Windows\System\QXOBBnL.exe
  2⤵
  PID:9512
- C:\Windows\System\ewTaQye.exe
  C:\Windows\System\ewTaQye.exe
  2⤵
  PID:9444
- C:\Windows\System\eSYQjjF.exe
  C:\Windows\System\eSYQjjF.exe
  2⤵
  PID:10184
- C:\Windows\System\xurBNGq.exe
  C:\Windows\System\xurBNGq.exe
  2⤵
  PID:9724
- C:\Windows\System\hjdABjZ.exe
  C:\Windows\System\hjdABjZ.exe
  2⤵
  PID:10144
- C:\Windows\System\XBNaOTQ.exe
  C:\Windows\System\XBNaOTQ.exe
  2⤵
  PID:9240
- C:\Windows\System\FoBCBgd.exe
  C:\Windows\System\FoBCBgd.exe
  2⤵
  PID:9368
- C:\Windows\System\Wublbax.exe
  C:\Windows\System\Wublbax.exe
  2⤵
  PID:9416
- C:\Windows\System\QGzYgqv.exe
  C:\Windows\System\QGzYgqv.exe
  2⤵
  PID:7840
- C:\Windows\System\FjFvgjs.exe
  C:\Windows\System\FjFvgjs.exe
  2⤵
  PID:9608
- C:\Windows\System\jpuEgJy.exe
  C:\Windows\System\jpuEgJy.exe
  2⤵
  PID:9348
- C:\Windows\System\mIoBfSD.exe
  C:\Windows\System\mIoBfSD.exe
  2⤵
  PID:10108
- C:\Windows\System\krNIDRd.exe
  C:\Windows\System\krNIDRd.exe
  2⤵
  PID:8796
- C:\Windows\System\KUnAllJ.exe
  C:\Windows\System\KUnAllJ.exe
  2⤵
  PID:9668
- C:\Windows\System\EKNvYgc.exe
  C:\Windows\System\EKNvYgc.exe
  2⤵
  PID:9892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BAgFuJo.exe

Filesize
1.6MB

MD5
38f991384bbc9292c348365b61fc2c28

SHA1
3cb39bbbe4beb3177abab445f926b2d7dba8379d

SHA256
78d82381a0d7f68079151a6981d3552bafe55e4e30bcdb4d6ff93e4e5ad03953

SHA512
ada84fc091333be1d5d51f0bb98df0ccc7b5cb191c0385512892e0d00362835178368a991ed4c3d4ebb39ca3a4cd0668f1108e8ba9723ca966ac575caebe35c9

Download Submit
C:\Windows\system\BKsaRNn.exe

Filesize
1.6MB

MD5
8e9601ce0d62d5e7e311529ba0c12460

SHA1
beddf20215d025137737554c1c617107a77f1d2d

SHA256
3ed7bfeaa12596d254334885bd67e7a2f9c9bd6355d0183110a78dab7af7d237

SHA512
2996c051d900d3f7047c442c4574cfd2b388fd6130fbdecd07af8b842f1753beebdee4ca31d9158286d3d0be2e87d97cbdeeebf83805ba329430a9b0429029ca

Download Submit
C:\Windows\system\CKrGLcQ.exe

Filesize
1.6MB

MD5
3cf507392fce67fa400c13992d96c61c

SHA1
2dabdc7c920b11b3163d44db2fe0821890f549ca

SHA256
c68ef0573213547f6bc9dee85d34bb6f9619c0a6738f481d32d2d6835a4f0476

SHA512
be62bbc5e4fade730aeb59877c82c9ded52441d133e74da8c14693993c3bbd08fe106dd7d93ccbca3be40dc690a0d56768767a6c301a21cb7fe1de6e0dad7964

Download Submit
C:\Windows\system\CueKmSC.exe

Filesize
1.6MB

MD5
99fdd29ee99d704d379f08e57d01c1e3

SHA1
b3f88f80c3e4b999a780a1d09588056f5be05c2c

SHA256
8a44ac5444a0f4a96a068cad802e1272f99d10ec379a392b38947ae6d2947380

SHA512
fa0086a84b21200eb8ae476f6cd51937bd972cc9f81ce2deb9c16e663e5290e8d2712707c7381fdb364f40d263016623e43dbb71f97fb75e417bb808aacfd47e

Download Submit
C:\Windows\system\GeqsOfd.exe

Filesize
1.6MB

MD5
ae55c6b402fec6533311a6151e52860f

SHA1
717d0f30338bdba15a1aca87a77b85d5e6792130

SHA256
fc98f147f719bc4730133439a669bbfa5e3cc7a1e43d1274f37ae981b0a725dc

SHA512
5182ca50e129a1e918f260754b0fdb2e2bcb8556d69e17946b53e6b9ca0cd2344c2be128d04d3f23fc286bccef28541f46f1fe1ecabf147cb6da2d32f851a8ad

Download Submit
C:\Windows\system\NMbMcGc.exe

Filesize
1.6MB

MD5
916fdcb0cc1151637dccc04f63ae620c

SHA1
2a5b000e74fb420647bdea5ec1bd3ebae368ee5d

SHA256
27b8ef524504473b9d09fbf74f5b0a3bc3b825786e8be73581e8098a49257f96

SHA512
5eea3914fe95a28c67e7bb00def9a26f1631a0a334d0aafa58f9b9db671e02f4ba9c3b1d60de348e9bd2922c212e782bd42b513acc83a8389f9868bcea959028

Download Submit
C:\Windows\system\ScsePMh.exe

Filesize
1.6MB

MD5
7fa0909e22188f67d4b76c608752a7b9

SHA1
dbe20495263a71955b3d4eefaed5d16ec9545665

SHA256
aea5f65c77948041c345b14e6eeb0037ae7f5b8cb94e9753dade19b87e7db1b1

SHA512
a579b38667256bc38eced119eab7235d12a0ec9c84378557b9888b07f4b6f6ef5f58d6ab7722031cca7b77eec1efc95f05ff26650bd49c0c5d8eeae4892bc7bc

Download Submit
C:\Windows\system\WSATlHr.exe

Filesize
1.6MB

MD5
a9b1fb2827decbf3e0a67c46ed189293

SHA1
38911b9d77220ad6444d93b4bdd2b3d0a0979644

SHA256
a91f17a75ac64912a951fab934fb5fdc77cfafc91515a61f153a440fc8ffff2c

SHA512
c1dff4e1443e4d9cc6f136fe2771e85f6f003cd7e48316a90dccccf48d9c79e13e3c8cb683fbc35858896a9383d1e0c6d4cbe3b0e6296270b1078d1cdadf5b96

Download Submit
C:\Windows\system\YhFTyFp.exe

Filesize
1.6MB

MD5
48d87710b95f4e03c80106f3069ff39a

SHA1
165102ee945d7a4f2b2f263911bcb6dc724f5a48

SHA256
704ba3eb37ae45c624dab87481b7654878b83d85bd85505a86298b617e26a4d3

SHA512
0d647c6fd91bd91c88d4fe5d8e09dc7da8b4fc3c2dc38a025cc0ab530ecd6ba15b5b77cb44110a57c1db5ae4d652808eab4d1828b48cff552e34c1f0b86fe765

Download Submit
C:\Windows\system\aJaLAro.exe

Filesize
1.6MB

MD5
cfb6c544abcb1c4dafab70fdf484536f

SHA1
7824906099d6f01a5023e6ea92d8e7a9006e7099

SHA256
315ea417f3473d0446cfeb385da57049cde0f10922aa90d947dfa2c3f188b61b

SHA512
a354c023c12feddfe268b549a664f97635beca31610940b88cbf2468087261e40a5933225027dc58ad670e8bb8aa5cfe2dbe42ffa616f66dff023f0e02c39724

Download Submit
C:\Windows\system\buOCEbB.exe

Filesize
1.6MB

MD5
9f510ae6eae571fae2ae21607a89a5d0

SHA1
1b42c1a1621d0586a15472c4090812bd3e0b695e

SHA256
a3f56d22344ddb050b8e35f2bdd4ac5c036707d853d346c2e6c4f41f65269bcd

SHA512
c7d3ed3b3561083f57be6ba858aece82f40956ebe349ca1200e784210d632bd6afdf0f0f741a2bcb08f6be167872c9d93a43f21b7903222f0d9601e5e2465896

Download Submit
C:\Windows\system\cScVuKf.exe

Filesize
1.6MB

MD5
4f8711eacb2fe6496e348171d6ae6bf0

SHA1
e4d6095f015914ace75a7a9fd9c3e33c35a583a0

SHA256
c7b6cde3419451287210e35b8823f8f29d09fbf45a46519604d3a89820486356

SHA512
2737a9fdc00f3176e094d52c6b48b2e0374ddf530c3c3e0c972164d84e68719b22924871d8f8527f5e6965a409110f7744417f0351d9a55357050c6d165d6930

Download Submit
C:\Windows\system\eGGjgbB.exe

Filesize
1.6MB

MD5
44b6eff971fbd2791c0b2cee6b1fa0c9

SHA1
3bb752aa9b187257a1050a604a6e4f13c77ef211

SHA256
609cd44ca31bee564d9b59b8248300c961d7e566a368e33e0bf9aa991d105843

SHA512
5531b4a49a3d84c576886553c02d47738e8131773639cba0b51804b0e0cf7e4ffdfea39a7ed0e55a67d47c28e1069593e45a3912a27756024c7858083bec07ef

Download Submit
C:\Windows\system\efDYeDw.exe

Filesize
1.6MB

MD5
0773a255968186493f8bd5bab82747d3

SHA1
5cec59434fd64872c002eaa11417a003a49cc220

SHA256
5137d73eb11090f30dd2a52c8e26918cce5aab7ca643923924e089fac4481a9e

SHA512
bbfcf5bb3fd35d0a84818085324e9f733ab6b72b958c33bbdda0d6bd67e8c891449ba0fd39981076f67de818e0f99b4f0ce1041ecb203eef2029b8eef9bcbbab

Download Submit
C:\Windows\system\iUGxDJk.exe

Filesize
1.6MB

MD5
ed846a6474fc19c6f67d835b537e7256

SHA1
26503776ec71a7b8c9f6d32f11726fef2099a8b4

SHA256
ae7a684912a6f7d1e51516c39b50d72c762ab6f561d6057389fb318fe958002a

SHA512
ce686a452b14c54f277bc6bcd9c608e9678c236cffb93a0174921381bc2968aeef2e6bcb99a87ce97dd898b62e9359aa6936ef796362bec367296fe76ae6b6d7

Download Submit
C:\Windows\system\iUpehJG.exe

Filesize
1.6MB

MD5
a781e6c235ee1fd242e44bbe7252609b

SHA1
2a752a700dc9cc5736301d2582d55328183c5839

SHA256
917dd890907b3d143a02710d1af3f699be5c80e95db206709a99df19303934b2

SHA512
c9a0b09c82588a52a645d3e16662f10e6fc60d8931204281e366ed250955b0252a4ac6ec71f98037cb454ac1f1a31aa43937aceef274465b89f277db8cf33654

Download Submit
C:\Windows\system\jPUEBwL.exe

Filesize
1.6MB

MD5
3ae6bc3377b161cba5b052110669b3fd

SHA1
d9df547438eb3514a18ffe64af525f9f75f2ec86

SHA256
36bc486e1333207ecf581074bf4ebb4df9aa67849d14ef7ab68139f44fc93e17

SHA512
98674dff38486b51998b2da5a2ff32a3607ae919c5220bd48a97ae16586fd062db8f7b9fcd4e14f2082901169880b254bf3aa23dc04dcf890154506204d89842

Download Submit
C:\Windows\system\lBtGhFt.exe

Filesize
1.6MB

MD5
abe79269bf5cd8d5f7c58339a4da5519

SHA1
15378e775cc17f4da8fd812475017b31812e166f

SHA256
51a6d5629cf738c1a025b6b6e0b056eea2d4b9e488233a3dea23fa8f543de0c7

SHA512
a2e0b25d379f100b0e9bca92b5b43894460bcf862e4215dbc8d5981185bdd483faa962e822c6dc9ce15a53a13a7bb63f0bd47cf3d0537899bf2d9ff1e8dc6ae6

Download Submit
C:\Windows\system\nnMlFoU.exe

Filesize
1.6MB

MD5
ccbbe9ed066580293d05dc0e9fd7b411

SHA1
2897eab93d7a11ded9286435f61d249f2c77079a

SHA256
e6c94a10ebf9fd90673bf2d352e3fad34be05ececfe02b54612593636556b1dc

SHA512
98992f3ad7893d60b9e0477fac051fc8e9cb3861621af5ce751a10ba9a88c87c1aec5f93589e6cab9440f9cc37d994b8b1257c801c290cc69cd2cb2e586a0bf8

Download Submit
C:\Windows\system\tvSArut.exe

Filesize
1.6MB

MD5
663c83d67d91040d328969a7d2f1ec33

SHA1
1878b48ef4b182be607991d3450838ff899827b0

SHA256
29310ae5a018488f65ea9061dca4740f8c45a546443e5d4f73a20a802b7396ba

SHA512
58aec86a017834fcda453412ae555576e63703e8276cd8268424d29ccde0de290b011fabca7a2876358d62edd0985baf076d67c24bfc69eef284e337a77a6f5c

Download Submit
C:\Windows\system\wqpvikl.exe

Filesize
1.6MB

MD5
fc9152abab40b7ea27be2269e3ea4990

SHA1
020e62ae0b910b7ed4c628b73bda7c7ede636086

SHA256
b335add0d69a4b8b6388f676ebff61b750cd47400df94e0a15dd6c58869d72a6

SHA512
3c4f1c631243919bd6f20dfdc1b2d72d3e82f17ecdff363ade1f67a8f3e0b48ebeb2660b7db36d94355862d3931ea02e65060a90fc1cf0b1918e56ccdb937b0c

Download Submit
C:\Windows\system\zlrnNdV.exe

Filesize
1.6MB

MD5
3b6124cd89c17cd0d2473c4c9c143409

SHA1
1261d4d9833ea9e494d70bcb6382544971ae6147

SHA256
f042fd32a1c3a2a81a5db59b6f32a948f2eafb378f4914bbc20aee32494cc5af

SHA512
6cbd9063db76fc81afa5d5df55ef70a8e4dcc5b4dde9ea3c25cbc54b7ad7756bdc3bae0d0c768dff518b718524c3b70820f4db1e8d23b53b1fc0184221198db3

Download Submit
\Windows\system\FxzzlJi.exe

Filesize
1.6MB

MD5
ebabe082fb5dcd04b59b75037f83d08e

SHA1
aebbb5aa940d4e93c35f3f2ad67d6c0f17014e91

SHA256
0c8d8ddd45ff60b7905c868f46b110603b1779b5878ebde62bfedac738732a35

SHA512
d2783da3a3296ff4059eaa575edfc7c200513338cf644ba507e98b043b8415fd0c36651a994940d9693fd1fcc40a70e52c0a0bca273d2da0c3e0ca7bc10d8250

Download Submit
\Windows\system\GLFmdZG.exe

Filesize
1.6MB

MD5
3fcc9445e491bccd3f178bb61bda2181

SHA1
e98a04e6515e0b3bb2218175dc19b4374940eec9

SHA256
983aa7ce101d7185c91a597bdfaba2fc572e7fa5bf58d539ac805e440be1ae30

SHA512
00ed237e9a5be75d6403308146d96bb45c891a658a2ed60011728f18eafb61520197583acc33df1029d23546b2a8dc400fe701a8ceee9d18fbecf4c67917df3d

Download Submit
\Windows\system\IoAOvOi.exe

Filesize
1.6MB

MD5
9d84fce332f381576940fcb366b4937e

SHA1
070a196e271afcd9815f0ca4d5ff4da53a145e6e

SHA256
115515aeb3d444f76b40bd97454a0bc7cfc26dfc4d6f7a23ac5417c5a94194d9

SHA512
b8385d606e5bf60b5933388be67b9a1fe2810963029361080afec31fc6533110f677abf9fcd771befa9b3447d50ff38cb1394148d95613196a47e47d9dbb983a

Download Submit
\Windows\system\LQeMfXV.exe

Filesize
1.6MB

MD5
ffc099a46882c655e1e84e171e694bd2

SHA1
37a2ca101e10ffba8bb1ced137b814bfb2e16a64

SHA256
70c18e5deff59e9d34569911b0e93343975c886a0fad91fc5cdf1e279bb8068a

SHA512
39a4eaacc78d0c453df3d38ae373c205c841a3f130f9b82fafdeb92e3a182cf1ccee69cad6452674e62c6273ee6ff82b43346b590899ca499f3c17a7af845341

Download Submit
\Windows\system\NgVSwYG.exe

Filesize
1.6MB

MD5
4562ec5f5775493d1004d0a628763e20

SHA1
cbc2d79d58e9eb37b5f43a1c4dbaad65cad0cca4

SHA256
45a1fc9e86bac53bb8eb0ec5471057fede23c104b34f98b35caa15cba5cb444e

SHA512
0f0d9c80d447eb2833916f882a6925dccf232fe2f7aa096ec484949cf9de20ecff959d67452a2a8b13926ca5b0601c7b341c277fa30374c940850eb10cf0dc45

Download Submit
\Windows\system\UPBoStZ.exe

Filesize
1.6MB

MD5
19cd149d13380f1e89c42c7e0ae4f2e5

SHA1
8dd5aedfd800f0b3fd1f453b99cdf2c28c86b0ac

SHA256
987ba1130e9338e102d0e71cda5f52bc970b2ad3ad1c92d43538414d943b4780

SHA512
69fea608870c8ce34ee0ff3087cf8e17a9b87807704fac94f1ad3805ea9b4eeb15e393834c99d97e5a66ffee03becc58460f75f56b10ab8d39a6e90267438384

Download Submit
\Windows\system\jQgUdty.exe

Filesize
1.6MB

MD5
c7b453ae7273b226c2eaad443830d4fa

SHA1
ececdf408a7bd3e51d6ba9735ff77a873feab412

SHA256
fe71ed57ff6f9777df645f57528f014fed0ef9808f4c2d176aef47afad5150b7

SHA512
c599f54968a1f784bea2b48d38bf649626167100b7ecc7c7f6ae40a15bd6d0859fe1a361bcdee72894150d9adf74c948e7947e560286a520d4c4bc53cdb31af8

Download Submit
\Windows\system\jvrNMjP.exe

Filesize
1.6MB

MD5
dbd96665d3f14e2a82c4f9018f1f9489

SHA1
1d7a2e19c8c321c6602953b9701f3ab966d82738

SHA256
c33be3e2a2e5ce52ca8f4f8f1ae76c88a6366a4261cb58950df1fa7df3eb3b95

SHA512
bb39a1e97f96004bb67d892e2a5ccf6be11554569997eb181cc09950e13715a1ba76dc66915aee3bc5a577daa430499fc9073db185f02a1c66f3ee0530089cf4

Download Submit
\Windows\system\khrfgJX.exe

Filesize
1.6MB

MD5
2e381054edb4fa5f5f90a3280915557e

SHA1
76ee1710a5e0e577cc0dc48b5dbd22ea03841e07

SHA256
7fcb6f8aacb3a153f0d6ce24ae2fd0515094b421071dfd49f2fc0f09525db508

SHA512
ff373fee7a1fcc984b224b517181eb8c34fe7112016635f184c1597000e2e60ece9f2e002c0df4918640e7f4c2ebdd0ea17aba60c44d1daa6d6ab1390adea0c0

Download Submit
\Windows\system\tHgCmgn.exe

Filesize
1.6MB

MD5
f3896fa6ece4654f379f0b0ca842a6d3

SHA1
e56d98901743e44c95c154b7c6dafb242bf98430

SHA256
0b66407b99c727c6c162c2e9f39ad556b79e7896edae994d206b9de90cb7aa54

SHA512
f9bad4a6c493fa6767c2a2357acb5019de708163c4c6dcb085d3e1117717e0835465d61caf3322f13800388b7815ec5841e7b5402efd47eec9735bfb15218f2f

Download Submit
memory/1044-3357-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1044-100-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-90-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-3443-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1228-472-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1784-87-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/1784-3371-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2232-93-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-3442-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-86-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-2242-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-81-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-3448-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-82-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-3812-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-375-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Filesize
9.6MB

Download
memory/2756-369-0x00000000029E0000-0x0000000002A60000-memory.dmp

Filesize
512KB

Download
memory/2756-27-0x000007FEF62AE000-0x000007FEF62AF000-memory.dmp

Filesize
4KB

Download
memory/2756-26-0x00000000029E0000-0x0000000002A60000-memory.dmp

Filesize
512KB

Download
memory/2756-92-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Filesize
9.6MB

Download
memory/2756-53-0x000007FEF5FF0000-0x000007FEF698D000-memory.dmp

Filesize
9.6MB

Download
memory/2756-241-0x0000000001D70000-0x0000000001D78000-memory.dmp

Filesize
32KB

Download
memory/2756-235-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

Filesize
2.9MB

Download
memory/2764-3444-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-9-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-97-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2800-465-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2800-84-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2800-0-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2800-98-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2800-73-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-91-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2800-80-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2800-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2800-8-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-553-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2800-85-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2800-291-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2900-14-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2900-2305-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2900-250-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2912-79-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-3786-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/3044-3361-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/3044-25-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/3044-313-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download