xmrig | ef3bbb414d42925a68b315fb3036521fe0c45b3b123c58237dfafba5077c6d4d

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
Size

2.2MB
MD5

0e9649ce5e7c6dbe9336b4879057ecff
SHA1

7f996c4deb0a42aaea010f64ab94331aa946cadd
SHA256

ef3bbb414d42925a68b315fb3036521fe0c45b3b123c58237dfafba5077c6d4d
SHA512

42fcc645784b98ec383aa29b943b5821f90ae2cd17fed9603aaa3b58dddac30a2b5e49096f949b7f4761809dc03b9ac95ad911a1201ffb9e76e9cd4671d7fbf3
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr2:NABB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/2220-56-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2092-71-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2692-985-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2108-360-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/2220-75-0x0000000003580000-0x0000000003972000-memory.dmp	xmrig
behavioral1/memory/2112-116-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2156-1164-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2468-1862-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2112-5661-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2432-5682-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2552-5725-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2712-5749-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2052-5693-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2172	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2092	vtFAEWb.exe
2112	FLZVBQy.exe
2108	NBrnBzx.exe
2692	PcsWKsK.exe
2156	ZTRCogl.exe
2468	aYYCnOa.exe
2712	gAlGvxz.exe
2432	rzKLXKb.exe
2552	iOmyGkm.exe
2052	ArDhryl.exe
2988	ycBEltk.exe
2820	jfVinof.exe
2968	uksErIj.exe
2420	rHyDcua.exe
1532	wOwgLmE.exe
2772	XVHwyKo.exe
1964	dmLncfr.exe
2848	xxNHnzL.exe
2956	ieMBwwS.exe
3028	HqLCwhm.exe
2472	zwGrAvt.exe
2892	cXMJbOy.exe
2636	QvoUBAK.exe
1592	xaBUOsY.exe
1420	evKZYmx.exe
336	WOKfeIP.exe
1468	QADXdts.exe
588	QGEQONg.exe
604	NygXXJg.exe
616	YfgBJoJ.exe
452	Omgcxiz.exe
2296	BVsubiR.exe
2208	SqNKzeL.exe
1768	LsCiJwO.exe
1824	pZgcJmi.exe
1880	rbxCrWm.exe
1744	lRLWuKq.exe
1980	WWYRSnp.exe
1584	VTFhDJD.exe
3048	FwQEXSB.exe
320	FSDQSnd.exe
1436	ChzeFAK.exe
3036	RQabWwA.exe
2916	LmFLXTG.exe
2024	jleVFup.exe
1928	PTeVwvC.exe
1728	MyRGdbk.exe
880	UJNUmrs.exe
2212	ZKDSFPE.exe
1032	mtQFzoQ.exe
1544	ErSKhDm.exe
1936	dQbJMkw.exe
1668	AFfMzUR.exe
2888	hgOssDv.exe
2560	pgLLNvh.exe
2548	SlOwVhr.exe
2456	HCkUXqX.exe
2408	IGiWwFa.exe
3020	KJOrAXn.exe
1644	jSSKrnH.exe
2656	aMzHLxS.exe
2980	TZfRvmr.exe
2416	OPvogNT.exe
1912	LiTylUX.exe

Loads dropped DLL 64 IoCs

pid	Process
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/files/0x00340000000144e4-12.dat	upx
behavioral1/files/0x0007000000014708-13.dat	upx
behavioral1/memory/2108-20-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/files/0x000700000001471d-30.dat	upx
behavioral1/memory/2156-40-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2468-46-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2220-56-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/2432-58-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2092-71-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/files/0x0006000000015d87-126.dat	upx
behavioral1/files/0x0006000000015ca6-66.dat	upx
behavioral1/files/0x0006000000015d79-109.dat	upx
behavioral1/files/0x00060000000161e7-179.dat	upx
behavioral1/memory/2692-985-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2108-360-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/files/0x000600000001630b-187.dat	upx
behavioral1/files/0x0006000000016117-178.dat	upx
behavioral1/files/0x0006000000015f6d-167.dat	upx
behavioral1/files/0x0006000000015fe9-172.dat	upx
behavioral1/files/0x0006000000015eaf-162.dat	upx
behavioral1/files/0x0006000000015e3a-157.dat	upx
behavioral1/files/0x0006000000015d56-142.dat	upx
behavioral1/files/0x0006000000015d28-140.dat	upx
behavioral1/files/0x0006000000015ceb-138.dat	upx
behavioral1/files/0x0006000000015cd5-136.dat	upx
behavioral1/files/0x0006000000015d8f-127.dat	upx
behavioral1/files/0x0006000000015d67-102.dat	upx
behavioral1/files/0x0006000000015d9b-146.dat	upx
behavioral1/memory/2052-81-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/files/0x0006000000015d6f-125.dat	upx
behavioral1/files/0x0006000000015d5e-124.dat	upx
behavioral1/files/0x0006000000015d4a-123.dat	upx
behavioral1/files/0x0006000000015d07-122.dat	upx
behavioral1/files/0x0006000000015ce1-121.dat	upx
behavioral1/files/0x0006000000015cba-120.dat	upx
behavioral1/memory/2112-116-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2156-1164-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2552-63-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2712-57-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/files/0x0006000000015be6-61.dat	upx
behavioral1/files/0x000700000001568c-55.dat	upx
behavioral1/files/0x000b000000014aa2-52.dat	upx
behavioral1/files/0x0007000000004e76-43.dat	upx
behavioral1/memory/2692-32-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x0007000000014726-38.dat	upx
behavioral1/memory/2112-16-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2092-8-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/files/0x000b000000014230-7.dat	upx
behavioral1/memory/2468-1862-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2112-5661-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2432-5682-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2552-5725-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2712-5749-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2052-5693-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JoTXCtu.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\VJZrOif.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\uWGMPph.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\HmmSCjs.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\fpVpKbo.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\TtqcTuy.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\amFmXXF.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\sEggiCm.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\zMCmCzd.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\WOKfeIP.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\UqOGcFS.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\MuUJiry.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\ywGDJfE.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\YXfgFxZ.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\rcOpvLa.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\jRrqYGr.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\IeQgjus.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\gAPJRlw.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\YsYzUbv.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\kSuJOId.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\nxFxXoz.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\wRkKbJV.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\byIttsZ.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\bsEivIz.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\EwAspbq.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\NrcyOpf.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\qrZleqx.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\tpVGYrY.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\nTxharA.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\HBEATNK.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\ScuTvaJ.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\GSOwqjq.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\iWUsHwm.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\GKBrcsu.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\cylQnnE.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\uaSrXox.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\cLbHZJy.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\ueUcvMj.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\EuxYTjm.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\OsHNUem.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\eqpDGNH.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\wKZDPSo.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\hFZvxCL.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\onVCsXa.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\GSEVdRm.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\KgfXUQv.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\SqTPWoC.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\LiAPhnJ.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\yFVLnSW.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\zzMjtYx.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\FWkbdwq.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\lyRLYyt.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\GcoZKxI.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\hBtBWAQ.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\ohyXqsc.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\FPGtdoU.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\KMczJNO.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\mQQgnYd.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\WVtMfdy.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\QmuaySQ.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\aCSOgtu.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\FcMIDJj.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\EyUSKTm.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
File created	C:\Windows\System\kmkmFLt.exe	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
Token: SeDebugPrivilege	2172	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2172	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	29
PID 2220 wrote to memory of 2172	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	29
PID 2220 wrote to memory of 2172	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	29
PID 2220 wrote to memory of 2092	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2092	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2092	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2112	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2112	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2112	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2108	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2108	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2108	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2692	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	33
PID 2220 wrote to memory of 2692	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	33
PID 2220 wrote to memory of 2692	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	33
PID 2220 wrote to memory of 2156	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2156	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2156	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2468	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	35
PID 2220 wrote to memory of 2468	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	35
PID 2220 wrote to memory of 2468	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	35
PID 2220 wrote to memory of 2712	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2712	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2712	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2432	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	37
PID 2220 wrote to memory of 2432	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	37
PID 2220 wrote to memory of 2432	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	37
PID 2220 wrote to memory of 2552	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2552	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2552	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2052	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	39
PID 2220 wrote to memory of 2052	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	39
PID 2220 wrote to memory of 2052	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	39
PID 2220 wrote to memory of 2988	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	40
PID 2220 wrote to memory of 2988	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	40
PID 2220 wrote to memory of 2988	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	40
PID 2220 wrote to memory of 2848	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	41
PID 2220 wrote to memory of 2848	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	41
PID 2220 wrote to memory of 2848	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	41
PID 2220 wrote to memory of 2820	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	42
PID 2220 wrote to memory of 2820	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	42
PID 2220 wrote to memory of 2820	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	42
PID 2220 wrote to memory of 2956	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	43
PID 2220 wrote to memory of 2956	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	43
PID 2220 wrote to memory of 2956	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	43
PID 2220 wrote to memory of 2968	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	44
PID 2220 wrote to memory of 2968	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	44
PID 2220 wrote to memory of 2968	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	44
PID 2220 wrote to memory of 3028	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	45
PID 2220 wrote to memory of 3028	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	45
PID 2220 wrote to memory of 3028	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	45
PID 2220 wrote to memory of 2420	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	46
PID 2220 wrote to memory of 2420	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	46
PID 2220 wrote to memory of 2420	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	46
PID 2220 wrote to memory of 2472	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	47
PID 2220 wrote to memory of 2472	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	47
PID 2220 wrote to memory of 2472	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	47
PID 2220 wrote to memory of 1532	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	48
PID 2220 wrote to memory of 1532	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	48
PID 2220 wrote to memory of 1532	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	48
PID 2220 wrote to memory of 2636	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	49
PID 2220 wrote to memory of 2636	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	49
PID 2220 wrote to memory of 2636	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	49
PID 2220 wrote to memory of 2772	2220	0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e9649ce5e7c6dbe9336b4879057ecff_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System\vtFAEWb.exe
  C:\Windows\System\vtFAEWb.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\FLZVBQy.exe
  C:\Windows\System\FLZVBQy.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\NBrnBzx.exe
  C:\Windows\System\NBrnBzx.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\PcsWKsK.exe
  C:\Windows\System\PcsWKsK.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ZTRCogl.exe
  C:\Windows\System\ZTRCogl.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\aYYCnOa.exe
  C:\Windows\System\aYYCnOa.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\gAlGvxz.exe
  C:\Windows\System\gAlGvxz.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\rzKLXKb.exe
  C:\Windows\System\rzKLXKb.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\iOmyGkm.exe
  C:\Windows\System\iOmyGkm.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ArDhryl.exe
  C:\Windows\System\ArDhryl.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\ycBEltk.exe
  C:\Windows\System\ycBEltk.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\xxNHnzL.exe
  C:\Windows\System\xxNHnzL.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\jfVinof.exe
  C:\Windows\System\jfVinof.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ieMBwwS.exe
  C:\Windows\System\ieMBwwS.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\uksErIj.exe
  C:\Windows\System\uksErIj.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\HqLCwhm.exe
  C:\Windows\System\HqLCwhm.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\rHyDcua.exe
  C:\Windows\System\rHyDcua.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\zwGrAvt.exe
  C:\Windows\System\zwGrAvt.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\wOwgLmE.exe
  C:\Windows\System\wOwgLmE.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\QvoUBAK.exe
  C:\Windows\System\QvoUBAK.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\XVHwyKo.exe
  C:\Windows\System\XVHwyKo.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\xaBUOsY.exe
  C:\Windows\System\xaBUOsY.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\dmLncfr.exe
  C:\Windows\System\dmLncfr.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\evKZYmx.exe
  C:\Windows\System\evKZYmx.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\cXMJbOy.exe
  C:\Windows\System\cXMJbOy.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\WOKfeIP.exe
  C:\Windows\System\WOKfeIP.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\QADXdts.exe
  C:\Windows\System\QADXdts.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\QGEQONg.exe
  C:\Windows\System\QGEQONg.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\NygXXJg.exe
  C:\Windows\System\NygXXJg.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\YfgBJoJ.exe
  C:\Windows\System\YfgBJoJ.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\Omgcxiz.exe
  C:\Windows\System\Omgcxiz.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\BVsubiR.exe
  C:\Windows\System\BVsubiR.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\SqNKzeL.exe
  C:\Windows\System\SqNKzeL.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\rbxCrWm.exe
  C:\Windows\System\rbxCrWm.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\LsCiJwO.exe
  C:\Windows\System\LsCiJwO.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\WWYRSnp.exe
  C:\Windows\System\WWYRSnp.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\pZgcJmi.exe
  C:\Windows\System\pZgcJmi.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\VTFhDJD.exe
  C:\Windows\System\VTFhDJD.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\lRLWuKq.exe
  C:\Windows\System\lRLWuKq.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\FwQEXSB.exe
  C:\Windows\System\FwQEXSB.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\FSDQSnd.exe
  C:\Windows\System\FSDQSnd.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\ChzeFAK.exe
  C:\Windows\System\ChzeFAK.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\RQabWwA.exe
  C:\Windows\System\RQabWwA.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\jleVFup.exe
  C:\Windows\System\jleVFup.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\LmFLXTG.exe
  C:\Windows\System\LmFLXTG.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\PTeVwvC.exe
  C:\Windows\System\PTeVwvC.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\MyRGdbk.exe
  C:\Windows\System\MyRGdbk.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\UJNUmrs.exe
  C:\Windows\System\UJNUmrs.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\ZKDSFPE.exe
  C:\Windows\System\ZKDSFPE.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\mtQFzoQ.exe
  C:\Windows\System\mtQFzoQ.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\ErSKhDm.exe
  C:\Windows\System\ErSKhDm.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\dQbJMkw.exe
  C:\Windows\System\dQbJMkw.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\AFfMzUR.exe
  C:\Windows\System\AFfMzUR.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\hgOssDv.exe
  C:\Windows\System\hgOssDv.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\pgLLNvh.exe
  C:\Windows\System\pgLLNvh.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\SlOwVhr.exe
  C:\Windows\System\SlOwVhr.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\HCkUXqX.exe
  C:\Windows\System\HCkUXqX.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\IGiWwFa.exe
  C:\Windows\System\IGiWwFa.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\KJOrAXn.exe
  C:\Windows\System\KJOrAXn.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\aMzHLxS.exe
  C:\Windows\System\aMzHLxS.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\jSSKrnH.exe
  C:\Windows\System\jSSKrnH.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\TZfRvmr.exe
  C:\Windows\System\TZfRvmr.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\OPvogNT.exe
  C:\Windows\System\OPvogNT.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\LiTylUX.exe
  C:\Windows\System\LiTylUX.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\HYjGShU.exe
  C:\Windows\System\HYjGShU.exe
  2⤵
  PID:2608
- C:\Windows\System\MNiTYkX.exe
  C:\Windows\System\MNiTYkX.exe
  2⤵
  PID:540
- C:\Windows\System\pFaRbgz.exe
  C:\Windows\System\pFaRbgz.exe
  2⤵
  PID:1496
- C:\Windows\System\FRzWCLN.exe
  C:\Windows\System\FRzWCLN.exe
  2⤵
  PID:2540
- C:\Windows\System\jZfTOBH.exe
  C:\Windows\System\jZfTOBH.exe
  2⤵
  PID:1720
- C:\Windows\System\otkDeVF.exe
  C:\Windows\System\otkDeVF.exe
  2⤵
  PID:300
- C:\Windows\System\GSEVdRm.exe
  C:\Windows\System\GSEVdRm.exe
  2⤵
  PID:1732
- C:\Windows\System\tyCfrXB.exe
  C:\Windows\System\tyCfrXB.exe
  2⤵
  PID:956
- C:\Windows\System\xlsNOGQ.exe
  C:\Windows\System\xlsNOGQ.exe
  2⤵
  PID:1640
- C:\Windows\System\ZndgTuA.exe
  C:\Windows\System\ZndgTuA.exe
  2⤵
  PID:1356
- C:\Windows\System\fIMdAwU.exe
  C:\Windows\System\fIMdAwU.exe
  2⤵
  PID:2160
- C:\Windows\System\loYkdWO.exe
  C:\Windows\System\loYkdWO.exe
  2⤵
  PID:1036
- C:\Windows\System\ugukZOa.exe
  C:\Windows\System\ugukZOa.exe
  2⤵
  PID:1324
- C:\Windows\System\tyDKQJk.exe
  C:\Windows\System\tyDKQJk.exe
  2⤵
  PID:620
- C:\Windows\System\hoQakRV.exe
  C:\Windows\System\hoQakRV.exe
  2⤵
  PID:700
- C:\Windows\System\wXFjHlM.exe
  C:\Windows\System\wXFjHlM.exe
  2⤵
  PID:2940
- C:\Windows\System\thBBPce.exe
  C:\Windows\System\thBBPce.exe
  2⤵
  PID:2928
- C:\Windows\System\bVWtqna.exe
  C:\Windows\System\bVWtqna.exe
  2⤵
  PID:2200
- C:\Windows\System\pwMJKIp.exe
  C:\Windows\System\pwMJKIp.exe
  2⤵
  PID:2924
- C:\Windows\System\BVqucEJ.exe
  C:\Windows\System\BVqucEJ.exe
  2⤵
  PID:1192
- C:\Windows\System\ttGJaVT.exe
  C:\Windows\System\ttGJaVT.exe
  2⤵
  PID:3052
- C:\Windows\System\EWltWeh.exe
  C:\Windows\System\EWltWeh.exe
  2⤵
  PID:1572
- C:\Windows\System\DsHDnHO.exe
  C:\Windows\System\DsHDnHO.exe
  2⤵
  PID:1564
- C:\Windows\System\MRgOvuk.exe
  C:\Windows\System\MRgOvuk.exe
  2⤵
  PID:1100
- C:\Windows\System\iOjJIEc.exe
  C:\Windows\System\iOjJIEc.exe
  2⤵
  PID:2492
- C:\Windows\System\lPYzXNM.exe
  C:\Windows\System\lPYzXNM.exe
  2⤵
  PID:2840
- C:\Windows\System\eFiZfli.exe
  C:\Windows\System\eFiZfli.exe
  2⤵
  PID:2356
- C:\Windows\System\WUrudEW.exe
  C:\Windows\System\WUrudEW.exe
  2⤵
  PID:3084
- C:\Windows\System\hScCDHg.exe
  C:\Windows\System\hScCDHg.exe
  2⤵
  PID:3168
- C:\Windows\System\JHoXfBb.exe
  C:\Windows\System\JHoXfBb.exe
  2⤵
  PID:3188
- C:\Windows\System\vVtvrSE.exe
  C:\Windows\System\vVtvrSE.exe
  2⤵
  PID:3204
- C:\Windows\System\GgPljlX.exe
  C:\Windows\System\GgPljlX.exe
  2⤵
  PID:3220
- C:\Windows\System\gAtWQKv.exe
  C:\Windows\System\gAtWQKv.exe
  2⤵
  PID:3244
- C:\Windows\System\hFpfeMT.exe
  C:\Windows\System\hFpfeMT.exe
  2⤵
  PID:3264
- C:\Windows\System\hBjPGuo.exe
  C:\Windows\System\hBjPGuo.exe
  2⤵
  PID:3288
- C:\Windows\System\wyVSOuD.exe
  C:\Windows\System\wyVSOuD.exe
  2⤵
  PID:3304
- C:\Windows\System\gebRAOe.exe
  C:\Windows\System\gebRAOe.exe
  2⤵
  PID:3324
- C:\Windows\System\QAHQpgA.exe
  C:\Windows\System\QAHQpgA.exe
  2⤵
  PID:3340
- C:\Windows\System\souaRJW.exe
  C:\Windows\System\souaRJW.exe
  2⤵
  PID:3360
- C:\Windows\System\mfPXjwf.exe
  C:\Windows\System\mfPXjwf.exe
  2⤵
  PID:3376
- C:\Windows\System\SDmGSrJ.exe
  C:\Windows\System\SDmGSrJ.exe
  2⤵
  PID:3392
- C:\Windows\System\BcWFjIj.exe
  C:\Windows\System\BcWFjIj.exe
  2⤵
  PID:3408
- C:\Windows\System\aOzBiSa.exe
  C:\Windows\System\aOzBiSa.exe
  2⤵
  PID:3428
- C:\Windows\System\ShICkrt.exe
  C:\Windows\System\ShICkrt.exe
  2⤵
  PID:3444
- C:\Windows\System\JYdAovd.exe
  C:\Windows\System\JYdAovd.exe
  2⤵
  PID:3464
- C:\Windows\System\SoRqFKd.exe
  C:\Windows\System\SoRqFKd.exe
  2⤵
  PID:3484
- C:\Windows\System\dSriVwV.exe
  C:\Windows\System\dSriVwV.exe
  2⤵
  PID:3544
- C:\Windows\System\eIcBvLc.exe
  C:\Windows\System\eIcBvLc.exe
  2⤵
  PID:3564
- C:\Windows\System\YIYSmOf.exe
  C:\Windows\System\YIYSmOf.exe
  2⤵
  PID:3580
- C:\Windows\System\NurCNlO.exe
  C:\Windows\System\NurCNlO.exe
  2⤵
  PID:3596
- C:\Windows\System\MRRpffP.exe
  C:\Windows\System\MRRpffP.exe
  2⤵
  PID:3620
- C:\Windows\System\fyqkOwq.exe
  C:\Windows\System\fyqkOwq.exe
  2⤵
  PID:3640
- C:\Windows\System\XgYhsux.exe
  C:\Windows\System\XgYhsux.exe
  2⤵
  PID:3664
- C:\Windows\System\WPpneVr.exe
  C:\Windows\System\WPpneVr.exe
  2⤵
  PID:3680
- C:\Windows\System\WjOYlqJ.exe
  C:\Windows\System\WjOYlqJ.exe
  2⤵
  PID:3700
- C:\Windows\System\nPnrfie.exe
  C:\Windows\System\nPnrfie.exe
  2⤵
  PID:3720
- C:\Windows\System\kSUIxLW.exe
  C:\Windows\System\kSUIxLW.exe
  2⤵
  PID:3736
- C:\Windows\System\cdpuSmx.exe
  C:\Windows\System\cdpuSmx.exe
  2⤵
  PID:3752
- C:\Windows\System\REeiEaX.exe
  C:\Windows\System\REeiEaX.exe
  2⤵
  PID:3768
- C:\Windows\System\QkLhDaO.exe
  C:\Windows\System\QkLhDaO.exe
  2⤵
  PID:3788
- C:\Windows\System\pWZPjuH.exe
  C:\Windows\System\pWZPjuH.exe
  2⤵
  PID:3812
- C:\Windows\System\kGnXZtn.exe
  C:\Windows\System\kGnXZtn.exe
  2⤵
  PID:3832
- C:\Windows\System\JBFYJdD.exe
  C:\Windows\System\JBFYJdD.exe
  2⤵
  PID:3848
- C:\Windows\System\gXIaznn.exe
  C:\Windows\System\gXIaznn.exe
  2⤵
  PID:3864
- C:\Windows\System\SWqIWWA.exe
  C:\Windows\System\SWqIWWA.exe
  2⤵
  PID:3884
- C:\Windows\System\JcaWiWr.exe
  C:\Windows\System\JcaWiWr.exe
  2⤵
  PID:3900
- C:\Windows\System\xXrdIrx.exe
  C:\Windows\System\xXrdIrx.exe
  2⤵
  PID:3916
- C:\Windows\System\dNPpsnu.exe
  C:\Windows\System\dNPpsnu.exe
  2⤵
  PID:3936
- C:\Windows\System\XcjKjkF.exe
  C:\Windows\System\XcjKjkF.exe
  2⤵
  PID:3984
- C:\Windows\System\EYQEbpV.exe
  C:\Windows\System\EYQEbpV.exe
  2⤵
  PID:4000
- C:\Windows\System\MDasMGX.exe
  C:\Windows\System\MDasMGX.exe
  2⤵
  PID:4020
- C:\Windows\System\MRbUyGr.exe
  C:\Windows\System\MRbUyGr.exe
  2⤵
  PID:4040
- C:\Windows\System\ObnPHsw.exe
  C:\Windows\System\ObnPHsw.exe
  2⤵
  PID:4056
- C:\Windows\System\ogGYaJH.exe
  C:\Windows\System\ogGYaJH.exe
  2⤵
  PID:4088
- C:\Windows\System\VVefNKT.exe
  C:\Windows\System\VVefNKT.exe
  2⤵
  PID:2876
- C:\Windows\System\naPmEZw.exe
  C:\Windows\System\naPmEZw.exe
  2⤵
  PID:2736
- C:\Windows\System\HGqsFiY.exe
  C:\Windows\System\HGqsFiY.exe
  2⤵
  PID:1380
- C:\Windows\System\gVOvyqt.exe
  C:\Windows\System\gVOvyqt.exe
  2⤵
  PID:2460
- C:\Windows\System\QHoQkSp.exe
  C:\Windows\System\QHoQkSp.exe
  2⤵
  PID:2920
- C:\Windows\System\LUpwlQy.exe
  C:\Windows\System\LUpwlQy.exe
  2⤵
  PID:2852
- C:\Windows\System\RiAzTEU.exe
  C:\Windows\System\RiAzTEU.exe
  2⤵
  PID:2804
- C:\Windows\System\gDQYDZb.exe
  C:\Windows\System\gDQYDZb.exe
  2⤵
  PID:1224
- C:\Windows\System\YqRvMey.exe
  C:\Windows\System\YqRvMey.exe
  2⤵
  PID:1392
- C:\Windows\System\hOXbRAy.exe
  C:\Windows\System\hOXbRAy.exe
  2⤵
  PID:1500
- C:\Windows\System\ICAXZfl.exe
  C:\Windows\System\ICAXZfl.exe
  2⤵
  PID:636
- C:\Windows\System\mApiLld.exe
  C:\Windows\System\mApiLld.exe
  2⤵
  PID:2792
- C:\Windows\System\jgqTTdf.exe
  C:\Windows\System\jgqTTdf.exe
  2⤵
  PID:332
- C:\Windows\System\cgsLVRY.exe
  C:\Windows\System\cgsLVRY.exe
  2⤵
  PID:2148
- C:\Windows\System\qPXAjzE.exe
  C:\Windows\System\qPXAjzE.exe
  2⤵
  PID:3100
- C:\Windows\System\NYooqgt.exe
  C:\Windows\System\NYooqgt.exe
  2⤵
  PID:3180
- C:\Windows\System\NKzMYjQ.exe
  C:\Windows\System\NKzMYjQ.exe
  2⤵
  PID:3132
- C:\Windows\System\oVrdmTf.exe
  C:\Windows\System\oVrdmTf.exe
  2⤵
  PID:3148
- C:\Windows\System\VfCOrXA.exe
  C:\Windows\System\VfCOrXA.exe
  2⤵
  PID:1648
- C:\Windows\System\uOQRiCj.exe
  C:\Windows\System\uOQRiCj.exe
  2⤵
  PID:2216
- C:\Windows\System\kiFEmvz.exe
  C:\Windows\System\kiFEmvz.exe
  2⤵
  PID:1784
- C:\Windows\System\MHZKbzO.exe
  C:\Windows\System\MHZKbzO.exe
  2⤵
  PID:1852
- C:\Windows\System\cxiZyTq.exe
  C:\Windows\System\cxiZyTq.exe
  2⤵
  PID:3232
- C:\Windows\System\JMAgwfT.exe
  C:\Windows\System\JMAgwfT.exe
  2⤵
  PID:3372
- C:\Windows\System\gurGnLi.exe
  C:\Windows\System\gurGnLi.exe
  2⤵
  PID:3440
- C:\Windows\System\jGDTaOP.exe
  C:\Windows\System\jGDTaOP.exe
  2⤵
  PID:3236
- C:\Windows\System\BTAlLMD.exe
  C:\Windows\System\BTAlLMD.exe
  2⤵
  PID:3556
- C:\Windows\System\qHNngoE.exe
  C:\Windows\System\qHNngoE.exe
  2⤵
  PID:3388
- C:\Windows\System\JysNFBZ.exe
  C:\Windows\System\JysNFBZ.exe
  2⤵
  PID:3420
- C:\Windows\System\kbzTGQu.exe
  C:\Windows\System\kbzTGQu.exe
  2⤵
  PID:3492
- C:\Windows\System\oWQRsMD.exe
  C:\Windows\System\oWQRsMD.exe
  2⤵
  PID:3588
- C:\Windows\System\AnQeAyv.exe
  C:\Windows\System\AnQeAyv.exe
  2⤵
  PID:3628
- C:\Windows\System\BaZYJbo.exe
  C:\Windows\System\BaZYJbo.exe
  2⤵
  PID:3708
- C:\Windows\System\wcLnvJn.exe
  C:\Windows\System\wcLnvJn.exe
  2⤵
  PID:3744
- C:\Windows\System\oOArYAg.exe
  C:\Windows\System\oOArYAg.exe
  2⤵
  PID:3784
- C:\Windows\System\TIgvjBT.exe
  C:\Windows\System\TIgvjBT.exe
  2⤵
  PID:3540
- C:\Windows\System\hwierFR.exe
  C:\Windows\System\hwierFR.exe
  2⤵
  PID:3612
- C:\Windows\System\dIJEvxo.exe
  C:\Windows\System\dIJEvxo.exe
  2⤵
  PID:3604
- C:\Windows\System\SXBhYmc.exe
  C:\Windows\System\SXBhYmc.exe
  2⤵
  PID:2192
- C:\Windows\System\YEUoJVj.exe
  C:\Windows\System\YEUoJVj.exe
  2⤵
  PID:3856
- C:\Windows\System\FsJmcNs.exe
  C:\Windows\System\FsJmcNs.exe
  2⤵
  PID:3928
- C:\Windows\System\FWFPlNS.exe
  C:\Windows\System\FWFPlNS.exe
  2⤵
  PID:3696
- C:\Windows\System\evukwAR.exe
  C:\Windows\System\evukwAR.exe
  2⤵
  PID:3880
- C:\Windows\System\KBHmtgO.exe
  C:\Windows\System\KBHmtgO.exe
  2⤵
  PID:3908
- C:\Windows\System\GkGLumT.exe
  C:\Windows\System\GkGLumT.exe
  2⤵
  PID:4032
- C:\Windows\System\FOSflCm.exe
  C:\Windows\System\FOSflCm.exe
  2⤵
  PID:4072
- C:\Windows\System\gZoHMkP.exe
  C:\Windows\System\gZoHMkP.exe
  2⤵
  PID:3952
- C:\Windows\System\RMbcnJk.exe
  C:\Windows\System\RMbcnJk.exe
  2⤵
  PID:3964
- C:\Windows\System\hfsvDrW.exe
  C:\Windows\System\hfsvDrW.exe
  2⤵
  PID:3764
- C:\Windows\System\ROfglAw.exe
  C:\Windows\System\ROfglAw.exe
  2⤵
  PID:4076
- C:\Windows\System\kzqbSwL.exe
  C:\Windows\System\kzqbSwL.exe
  2⤵
  PID:4012
- C:\Windows\System\xiTJsoE.exe
  C:\Windows\System\xiTJsoE.exe
  2⤵
  PID:916
- C:\Windows\System\PCzsraI.exe
  C:\Windows\System\PCzsraI.exe
  2⤵
  PID:1856
- C:\Windows\System\TtqQAsP.exe
  C:\Windows\System\TtqQAsP.exe
  2⤵
  PID:1796
- C:\Windows\System\kOBpCDp.exe
  C:\Windows\System\kOBpCDp.exe
  2⤵
  PID:2000
- C:\Windows\System\rrLawrn.exe
  C:\Windows\System\rrLawrn.exe
  2⤵
  PID:3176
- C:\Windows\System\roSaglP.exe
  C:\Windows\System\roSaglP.exe
  2⤵
  PID:1996
- C:\Windows\System\VciAMDV.exe
  C:\Windows\System\VciAMDV.exe
  2⤵
  PID:2340
- C:\Windows\System\ITtebib.exe
  C:\Windows\System\ITtebib.exe
  2⤵
  PID:2812
- C:\Windows\System\IbphtBs.exe
  C:\Windows\System\IbphtBs.exe
  2⤵
  PID:1932
- C:\Windows\System\ZOVLEAj.exe
  C:\Windows\System\ZOVLEAj.exe
  2⤵
  PID:2120
- C:\Windows\System\hxTXRPi.exe
  C:\Windows\System\hxTXRPi.exe
  2⤵
  PID:3092
- C:\Windows\System\rPeWyQH.exe
  C:\Windows\System\rPeWyQH.exe
  2⤵
  PID:3256
- C:\Windows\System\IKERhnx.exe
  C:\Windows\System\IKERhnx.exe
  2⤵
  PID:3108
- C:\Windows\System\fLtTCar.exe
  C:\Windows\System\fLtTCar.exe
  2⤵
  PID:3300
- C:\Windows\System\NCiHRBn.exe
  C:\Windows\System\NCiHRBn.exe
  2⤵
  PID:3272
- C:\Windows\System\cIUWBtI.exe
  C:\Windows\System\cIUWBtI.exe
  2⤵
  PID:3460
- C:\Windows\System\BatLwXs.exe
  C:\Windows\System\BatLwXs.exe
  2⤵
  PID:3716
- C:\Windows\System\eIAVwIY.exe
  C:\Windows\System\eIAVwIY.exe
  2⤵
  PID:2268
- C:\Windows\System\DuDkPuo.exe
  C:\Windows\System\DuDkPuo.exe
  2⤵
  PID:2056
- C:\Windows\System\dtzkLog.exe
  C:\Windows\System\dtzkLog.exe
  2⤵
  PID:3616
- C:\Windows\System\KywtnVl.exe
  C:\Windows\System\KywtnVl.exe
  2⤵
  PID:3692
- C:\Windows\System\oNZnZVQ.exe
  C:\Windows\System\oNZnZVQ.exe
  2⤵
  PID:4068
- C:\Windows\System\gFdgOKK.exe
  C:\Windows\System\gFdgOKK.exe
  2⤵
  PID:2732
- C:\Windows\System\JYkGzoL.exe
  C:\Windows\System\JYkGzoL.exe
  2⤵
  PID:1764
- C:\Windows\System\UNyDdgO.exe
  C:\Windows\System\UNyDdgO.exe
  2⤵
  PID:660
- C:\Windows\System\TfqDZWu.exe
  C:\Windows\System\TfqDZWu.exe
  2⤵
  PID:1128
- C:\Windows\System\BjObHmA.exe
  C:\Windows\System\BjObHmA.exe
  2⤵
  PID:2564
- C:\Windows\System\VrfPTmf.exe
  C:\Windows\System\VrfPTmf.exe
  2⤵
  PID:3336
- C:\Windows\System\GiWvoHx.exe
  C:\Windows\System\GiWvoHx.exe
  2⤵
  PID:4104
- C:\Windows\System\dAGidMe.exe
  C:\Windows\System\dAGidMe.exe
  2⤵
  PID:4120
- C:\Windows\System\sxvysvG.exe
  C:\Windows\System\sxvysvG.exe
  2⤵
  PID:4136
- C:\Windows\System\LsCgZqo.exe
  C:\Windows\System\LsCgZqo.exe
  2⤵
  PID:4152
- C:\Windows\System\XHIKaDt.exe
  C:\Windows\System\XHIKaDt.exe
  2⤵
  PID:4168
- C:\Windows\System\bLpiPkc.exe
  C:\Windows\System\bLpiPkc.exe
  2⤵
  PID:4184
- C:\Windows\System\MfYpGbY.exe
  C:\Windows\System\MfYpGbY.exe
  2⤵
  PID:4200
- C:\Windows\System\cdgstIW.exe
  C:\Windows\System\cdgstIW.exe
  2⤵
  PID:4216
- C:\Windows\System\pkMEtOw.exe
  C:\Windows\System\pkMEtOw.exe
  2⤵
  PID:4232
- C:\Windows\System\sEtKHKY.exe
  C:\Windows\System\sEtKHKY.exe
  2⤵
  PID:4248
- C:\Windows\System\MYhgUyJ.exe
  C:\Windows\System\MYhgUyJ.exe
  2⤵
  PID:4264
- C:\Windows\System\qRLmVaT.exe
  C:\Windows\System\qRLmVaT.exe
  2⤵
  PID:4280
- C:\Windows\System\jhDhRxa.exe
  C:\Windows\System\jhDhRxa.exe
  2⤵
  PID:4296
- C:\Windows\System\WPvTWNF.exe
  C:\Windows\System\WPvTWNF.exe
  2⤵
  PID:4312
- C:\Windows\System\nXuxsvc.exe
  C:\Windows\System\nXuxsvc.exe
  2⤵
  PID:4328
- C:\Windows\System\AEDufWC.exe
  C:\Windows\System\AEDufWC.exe
  2⤵
  PID:4344
- C:\Windows\System\szDZFzU.exe
  C:\Windows\System\szDZFzU.exe
  2⤵
  PID:4360
- C:\Windows\System\oiOgfGW.exe
  C:\Windows\System\oiOgfGW.exe
  2⤵
  PID:4376
- C:\Windows\System\uRSYVbs.exe
  C:\Windows\System\uRSYVbs.exe
  2⤵
  PID:4396
- C:\Windows\System\AoVTEtX.exe
  C:\Windows\System\AoVTEtX.exe
  2⤵
  PID:4412
- C:\Windows\System\QjXryhX.exe
  C:\Windows\System\QjXryhX.exe
  2⤵
  PID:4428
- C:\Windows\System\dUIFOkm.exe
  C:\Windows\System\dUIFOkm.exe
  2⤵
  PID:4444
- C:\Windows\System\uQgklul.exe
  C:\Windows\System\uQgklul.exe
  2⤵
  PID:4460
- C:\Windows\System\DCyQwGc.exe
  C:\Windows\System\DCyQwGc.exe
  2⤵
  PID:4476
- C:\Windows\System\FjQMRTl.exe
  C:\Windows\System\FjQMRTl.exe
  2⤵
  PID:4496
- C:\Windows\System\IbIJZGB.exe
  C:\Windows\System\IbIJZGB.exe
  2⤵
  PID:4512
- C:\Windows\System\OcdBJnt.exe
  C:\Windows\System\OcdBJnt.exe
  2⤵
  PID:4528
- C:\Windows\System\LXbVsEK.exe
  C:\Windows\System\LXbVsEK.exe
  2⤵
  PID:4544
- C:\Windows\System\pVNwGsi.exe
  C:\Windows\System\pVNwGsi.exe
  2⤵
  PID:4560
- C:\Windows\System\qpizMWL.exe
  C:\Windows\System\qpizMWL.exe
  2⤵
  PID:4576
- C:\Windows\System\YGTZSNJ.exe
  C:\Windows\System\YGTZSNJ.exe
  2⤵
  PID:4592
- C:\Windows\System\rvIakGi.exe
  C:\Windows\System\rvIakGi.exe
  2⤵
  PID:4608
- C:\Windows\System\yFKozyG.exe
  C:\Windows\System\yFKozyG.exe
  2⤵
  PID:4624
- C:\Windows\System\BTUZhwi.exe
  C:\Windows\System\BTUZhwi.exe
  2⤵
  PID:4640
- C:\Windows\System\xnzVreY.exe
  C:\Windows\System\xnzVreY.exe
  2⤵
  PID:4656
- C:\Windows\System\MBibEoD.exe
  C:\Windows\System\MBibEoD.exe
  2⤵
  PID:4676
- C:\Windows\System\UQfGdQr.exe
  C:\Windows\System\UQfGdQr.exe
  2⤵
  PID:4692
- C:\Windows\System\ohyXqsc.exe
  C:\Windows\System\ohyXqsc.exe
  2⤵
  PID:4708
- C:\Windows\System\XfPINws.exe
  C:\Windows\System\XfPINws.exe
  2⤵
  PID:4724
- C:\Windows\System\JBZqgol.exe
  C:\Windows\System\JBZqgol.exe
  2⤵
  PID:4740
- C:\Windows\System\bvHpMDg.exe
  C:\Windows\System\bvHpMDg.exe
  2⤵
  PID:4756
- C:\Windows\System\Bnvxraq.exe
  C:\Windows\System\Bnvxraq.exe
  2⤵
  PID:4776
- C:\Windows\System\zRWKYEC.exe
  C:\Windows\System\zRWKYEC.exe
  2⤵
  PID:4796
- C:\Windows\System\yLKornS.exe
  C:\Windows\System\yLKornS.exe
  2⤵
  PID:4812
- C:\Windows\System\rARVUyh.exe
  C:\Windows\System\rARVUyh.exe
  2⤵
  PID:4828
- C:\Windows\System\WMDhdOs.exe
  C:\Windows\System\WMDhdOs.exe
  2⤵
  PID:4856
- C:\Windows\System\KmYEzzB.exe
  C:\Windows\System\KmYEzzB.exe
  2⤵
  PID:4876
- C:\Windows\System\HzxzNXU.exe
  C:\Windows\System\HzxzNXU.exe
  2⤵
  PID:4892
- C:\Windows\System\RcBYzzc.exe
  C:\Windows\System\RcBYzzc.exe
  2⤵
  PID:4908
- C:\Windows\System\cBXEydr.exe
  C:\Windows\System\cBXEydr.exe
  2⤵
  PID:4924
- C:\Windows\System\ipxrOmx.exe
  C:\Windows\System\ipxrOmx.exe
  2⤵
  PID:4940
- C:\Windows\System\SDjRojH.exe
  C:\Windows\System\SDjRojH.exe
  2⤵
  PID:4964
- C:\Windows\System\JjsvgxV.exe
  C:\Windows\System\JjsvgxV.exe
  2⤵
  PID:4980
- C:\Windows\System\GUZKJfk.exe
  C:\Windows\System\GUZKJfk.exe
  2⤵
  PID:5000
- C:\Windows\System\QMjFTiD.exe
  C:\Windows\System\QMjFTiD.exe
  2⤵
  PID:5016
- C:\Windows\System\MzXtZNX.exe
  C:\Windows\System\MzXtZNX.exe
  2⤵
  PID:5032
- C:\Windows\System\eRnUPtW.exe
  C:\Windows\System\eRnUPtW.exe
  2⤵
  PID:5052
- C:\Windows\System\NdCEJkZ.exe
  C:\Windows\System\NdCEJkZ.exe
  2⤵
  PID:5068
- C:\Windows\System\HrDARsU.exe
  C:\Windows\System\HrDARsU.exe
  2⤵
  PID:5084
- C:\Windows\System\OSFTgjS.exe
  C:\Windows\System\OSFTgjS.exe
  2⤵
  PID:896
- C:\Windows\System\ENeTIAN.exe
  C:\Windows\System\ENeTIAN.exe
  2⤵
  PID:1432
- C:\Windows\System\PjqIruT.exe
  C:\Windows\System\PjqIruT.exe
  2⤵
  PID:1712
- C:\Windows\System\ciXCkOP.exe
  C:\Windows\System\ciXCkOP.exe
  2⤵
  PID:4424
- C:\Windows\System\JkSMWQm.exe
  C:\Windows\System\JkSMWQm.exe
  2⤵
  PID:860
- C:\Windows\System\eCXlZTI.exe
  C:\Windows\System\eCXlZTI.exe
  2⤵
  PID:3216
- C:\Windows\System\kEPwjwI.exe
  C:\Windows\System\kEPwjwI.exe
  2⤵
  PID:4556
- C:\Windows\System\GipAXvE.exe
  C:\Windows\System\GipAXvE.exe
  2⤵
  PID:3352
- C:\Windows\System\eSQLnWS.exe
  C:\Windows\System\eSQLnWS.exe
  2⤵
  PID:1548
- C:\Windows\System\axWXsen.exe
  C:\Windows\System\axWXsen.exe
  2⤵
  PID:4684
- C:\Windows\System\koaOBWf.exe
  C:\Windows\System\koaOBWf.exe
  2⤵
  PID:4720
- C:\Windows\System\SoRTpaN.exe
  C:\Windows\System\SoRTpaN.exe
  2⤵
  PID:3824
- C:\Windows\System\vEjRNyQ.exe
  C:\Windows\System\vEjRNyQ.exe
  2⤵
  PID:4148
- C:\Windows\System\eTOUBlv.exe
  C:\Windows\System\eTOUBlv.exe
  2⤵
  PID:3260
- C:\Windows\System\gEukLnR.exe
  C:\Windows\System\gEukLnR.exe
  2⤵
  PID:4180
- C:\Windows\System\pXJoNeE.exe
  C:\Windows\System\pXJoNeE.exe
  2⤵
  PID:4212
- C:\Windows\System\ANmbqCu.exe
  C:\Windows\System\ANmbqCu.exe
  2⤵
  PID:4048
- C:\Windows\System\NiSFIFc.exe
  C:\Windows\System\NiSFIFc.exe
  2⤵
  PID:3508
- C:\Windows\System\vIykNpb.exe
  C:\Windows\System\vIykNpb.exe
  2⤵
  PID:4132
- C:\Windows\System\vUewXow.exe
  C:\Windows\System\vUewXow.exe
  2⤵
  PID:4196
- C:\Windows\System\OwZRwzt.exe
  C:\Windows\System\OwZRwzt.exe
  2⤵
  PID:3636
- C:\Windows\System\peBLBsk.exe
  C:\Windows\System\peBLBsk.exe
  2⤵
  PID:3820
- C:\Windows\System\CtZZbGX.exe
  C:\Windows\System\CtZZbGX.exe
  2⤵
  PID:3140
- C:\Windows\System\RIgRuUi.exe
  C:\Windows\System\RIgRuUi.exe
  2⤵
  PID:4112
- C:\Windows\System\oxKPmRp.exe
  C:\Windows\System\oxKPmRp.exe
  2⤵
  PID:4288
- C:\Windows\System\TEeIqva.exe
  C:\Windows\System\TEeIqva.exe
  2⤵
  PID:2976
- C:\Windows\System\zcZKXyN.exe
  C:\Windows\System\zcZKXyN.exe
  2⤵
  PID:4820
- C:\Windows\System\czEzUDN.exe
  C:\Windows\System\czEzUDN.exe
  2⤵
  PID:4936
- C:\Windows\System\LvZyYjq.exe
  C:\Windows\System\LvZyYjq.exe
  2⤵
  PID:4972
- C:\Windows\System\TbEtRyv.exe
  C:\Windows\System\TbEtRyv.exe
  2⤵
  PID:5040
- C:\Windows\System\aalbmNG.exe
  C:\Windows\System\aalbmNG.exe
  2⤵
  PID:2524
- C:\Windows\System\NEyeenS.exe
  C:\Windows\System\NEyeenS.exe
  2⤵
  PID:4276
- C:\Windows\System\LksikoI.exe
  C:\Windows\System\LksikoI.exe
  2⤵
  PID:4336
- C:\Windows\System\AghKTfp.exe
  C:\Windows\System\AghKTfp.exe
  2⤵
  PID:4404
- C:\Windows\System\JqGBuyl.exe
  C:\Windows\System\JqGBuyl.exe
  2⤵
  PID:4440
- C:\Windows\System\lbMwdow.exe
  C:\Windows\System\lbMwdow.exe
  2⤵
  PID:4472
- C:\Windows\System\JlzumiR.exe
  C:\Windows\System\JlzumiR.exe
  2⤵
  PID:4572
- C:\Windows\System\PsqtTeH.exe
  C:\Windows\System\PsqtTeH.exe
  2⤵
  PID:4636
- C:\Windows\System\sTbbWdq.exe
  C:\Windows\System\sTbbWdq.exe
  2⤵
  PID:4704
- C:\Windows\System\ZorKdXs.exe
  C:\Windows\System\ZorKdXs.exe
  2⤵
  PID:4764
- C:\Windows\System\bFgSPNt.exe
  C:\Windows\System\bFgSPNt.exe
  2⤵
  PID:4808
- C:\Windows\System\wvwxayO.exe
  C:\Windows\System\wvwxayO.exe
  2⤵
  PID:4848
- C:\Windows\System\DOqppWk.exe
  C:\Windows\System\DOqppWk.exe
  2⤵
  PID:4916
- C:\Windows\System\xzkjmyf.exe
  C:\Windows\System\xzkjmyf.exe
  2⤵
  PID:4956
- C:\Windows\System\TLdJAVx.exe
  C:\Windows\System\TLdJAVx.exe
  2⤵
  PID:4996
- C:\Windows\System\FyiqOGM.exe
  C:\Windows\System\FyiqOGM.exe
  2⤵
  PID:5064
- C:\Windows\System\NFSQttF.exe
  C:\Windows\System\NFSQttF.exe
  2⤵
  PID:5104
- C:\Windows\System\GsEXRKI.exe
  C:\Windows\System\GsEXRKI.exe
  2⤵
  PID:3404
- C:\Windows\System\VIeNQEw.exe
  C:\Windows\System\VIeNQEw.exe
  2⤵
  PID:1860
- C:\Windows\System\txavgRA.exe
  C:\Windows\System\txavgRA.exe
  2⤵
  PID:3676
- C:\Windows\System\JrUCEmz.exe
  C:\Windows\System\JrUCEmz.exe
  2⤵
  PID:3892
- C:\Windows\System\dMcwGYf.exe
  C:\Windows\System\dMcwGYf.exe
  2⤵
  PID:4028
- C:\Windows\System\TPEVsqb.exe
  C:\Windows\System\TPEVsqb.exe
  2⤵
  PID:3808
- C:\Windows\System\JYvoRCX.exe
  C:\Windows\System\JYvoRCX.exe
  2⤵
  PID:4864
- C:\Windows\System\ymMApTF.exe
  C:\Windows\System\ymMApTF.exe
  2⤵
  PID:3780
- C:\Windows\System\uSpiywW.exe
  C:\Windows\System\uSpiywW.exe
  2⤵
  PID:4308
- C:\Windows\System\RRQmtgI.exe
  C:\Windows\System\RRQmtgI.exe
  2⤵
  PID:4588
- C:\Windows\System\mvtXjeL.exe
  C:\Windows\System\mvtXjeL.exe
  2⤵
  PID:2704
- C:\Windows\System\eQpXWdB.exe
  C:\Windows\System\eQpXWdB.exe
  2⤵
  PID:4784
- C:\Windows\System\iXqeQOD.exe
  C:\Windows\System\iXqeQOD.exe
  2⤵
  PID:4508
- C:\Windows\System\ONrMFyU.exe
  C:\Windows\System\ONrMFyU.exe
  2⤵
  PID:4844
- C:\Windows\System\TVCboNa.exe
  C:\Windows\System\TVCboNa.exe
  2⤵
  PID:2824
- C:\Windows\System\ZAYgEqz.exe
  C:\Windows\System\ZAYgEqz.exe
  2⤵
  PID:3576
- C:\Windows\System\tJlSQxk.exe
  C:\Windows\System\tJlSQxk.exe
  2⤵
  PID:2180
- C:\Windows\System\MjPndhD.exe
  C:\Windows\System\MjPndhD.exe
  2⤵
  PID:1664
- C:\Windows\System\ABRdTcC.exe
  C:\Windows\System\ABRdTcC.exe
  2⤵
  PID:1256
- C:\Windows\System\mPACTdD.exe
  C:\Windows\System\mPACTdD.exe
  2⤵
  PID:1588
- C:\Windows\System\ykfIpzB.exe
  C:\Windows\System\ykfIpzB.exe
  2⤵
  PID:2632
- C:\Windows\System\EzhKurf.exe
  C:\Windows\System\EzhKurf.exe
  2⤵
  PID:2800
- C:\Windows\System\RlrBvVe.exe
  C:\Windows\System\RlrBvVe.exe
  2⤵
  PID:2972
- C:\Windows\System\atjJXqT.exe
  C:\Windows\System\atjJXqT.exe
  2⤵
  PID:4452
- C:\Windows\System\uNJRILR.exe
  C:\Windows\System\uNJRILR.exe
  2⤵
  PID:576
- C:\Windows\System\wJBvJhM.exe
  C:\Windows\System\wJBvJhM.exe
  2⤵
  PID:4484
- C:\Windows\System\HyajzoE.exe
  C:\Windows\System\HyajzoE.exe
  2⤵
  PID:1524
- C:\Windows\System\lBakysB.exe
  C:\Windows\System\lBakysB.exe
  2⤵
  PID:4648
- C:\Windows\System\EFiyzxq.exe
  C:\Windows\System\EFiyzxq.exe
  2⤵
  PID:2392
- C:\Windows\System\yBwctGJ.exe
  C:\Windows\System\yBwctGJ.exe
  2⤵
  PID:2068
- C:\Windows\System\MDIPXtV.exe
  C:\Windows\System\MDIPXtV.exe
  2⤵
  PID:4228
- C:\Windows\System\PjMQPRn.exe
  C:\Windows\System\PjMQPRn.exe
  2⤵
  PID:1788
- C:\Windows\System\ZGAsxMs.exe
  C:\Windows\System\ZGAsxMs.exe
  2⤵
  PID:4208
- C:\Windows\System\PMhVRMU.exe
  C:\Windows\System\PMhVRMU.exe
  2⤵
  PID:312
- C:\Windows\System\kQtzPPc.exe
  C:\Windows\System\kQtzPPc.exe
  2⤵
  PID:4872
- C:\Windows\System\giVRGFa.exe
  C:\Windows\System\giVRGFa.exe
  2⤵
  PID:3316
- C:\Windows\System\mDpJBbM.exe
  C:\Windows\System\mDpJBbM.exe
  2⤵
  PID:2884
- C:\Windows\System\tFFWOBm.exe
  C:\Windows\System\tFFWOBm.exe
  2⤵
  PID:360
- C:\Windows\System\fMVTSNq.exe
  C:\Windows\System\fMVTSNq.exe
  2⤵
  PID:2604
- C:\Windows\System\eAwheif.exe
  C:\Windows\System\eAwheif.exe
  2⤵
  PID:1716
- C:\Windows\System\XfxBsKW.exe
  C:\Windows\System\XfxBsKW.exe
  2⤵
  PID:1472
- C:\Windows\System\fphyomZ.exe
  C:\Windows\System\fphyomZ.exe
  2⤵
  PID:4368
- C:\Windows\System\hCNiiKz.exe
  C:\Windows\System\hCNiiKz.exe
  2⤵
  PID:4372
- C:\Windows\System\iaMJwwW.exe
  C:\Windows\System\iaMJwwW.exe
  2⤵
  PID:4952
- C:\Windows\System\jzdRCpR.exe
  C:\Windows\System\jzdRCpR.exe
  2⤵
  PID:3120
- C:\Windows\System\PbAlKWw.exe
  C:\Windows\System\PbAlKWw.exe
  2⤵
  PID:4888
- C:\Windows\System\IsrzLAc.exe
  C:\Windows\System\IsrzLAc.exe
  2⤵
  PID:108
- C:\Windows\System\uJNRkoF.exe
  C:\Windows\System\uJNRkoF.exe
  2⤵
  PID:3032
- C:\Windows\System\YtzegQb.exe
  C:\Windows\System\YtzegQb.exe
  2⤵
  PID:3156
- C:\Windows\System\UKOonNR.exe
  C:\Windows\System\UKOonNR.exe
  2⤵
  PID:3480
- C:\Windows\System\Wpptccl.exe
  C:\Windows\System\Wpptccl.exe
  2⤵
  PID:5112
- C:\Windows\System\imgvaOF.exe
  C:\Windows\System\imgvaOF.exe
  2⤵
  PID:3200
- C:\Windows\System\udISEHT.exe
  C:\Windows\System\udISEHT.exe
  2⤵
  PID:2588
- C:\Windows\System\BnvxoxQ.exe
  C:\Windows\System\BnvxoxQ.exe
  2⤵
  PID:3776
- C:\Windows\System\ORuGrIb.exe
  C:\Windows\System\ORuGrIb.exe
  2⤵
  PID:3456
- C:\Windows\System\ninUbli.exe
  C:\Windows\System\ninUbli.exe
  2⤵
  PID:2856
- C:\Windows\System\QzKyCQw.exe
  C:\Windows\System\QzKyCQw.exe
  2⤵
  PID:2844
- C:\Windows\System\lxIKJOx.exe
  C:\Windows\System\lxIKJOx.exe
  2⤵
  PID:2428
- C:\Windows\System\LkDgvZH.exe
  C:\Windows\System\LkDgvZH.exe
  2⤵
  PID:3080
- C:\Windows\System\FhGggTJ.exe
  C:\Windows\System\FhGggTJ.exe
  2⤵
  PID:1960
- C:\Windows\System\UYbLKJT.exe
  C:\Windows\System\UYbLKJT.exe
  2⤵
  PID:412
- C:\Windows\System\QEFarmm.exe
  C:\Windows\System\QEFarmm.exe
  2⤵
  PID:1948
- C:\Windows\System\WCbMXQG.exe
  C:\Windows\System\WCbMXQG.exe
  2⤵
  PID:4456
- C:\Windows\System\ePGGYXj.exe
  C:\Windows\System\ePGGYXj.exe
  2⤵
  PID:1816
- C:\Windows\System\eFNoLYf.exe
  C:\Windows\System\eFNoLYf.exe
  2⤵
  PID:4584
- C:\Windows\System\iyycBul.exe
  C:\Windows\System\iyycBul.exe
  2⤵
  PID:4128
- C:\Windows\System\PQxtgZh.exe
  C:\Windows\System\PQxtgZh.exe
  2⤵
  PID:3104
- C:\Windows\System\txmGkgi.exe
  C:\Windows\System\txmGkgi.exe
  2⤵
  PID:4748
- C:\Windows\System\rZzdwNo.exe
  C:\Windows\System\rZzdwNo.exe
  2⤵
  PID:4144
- C:\Windows\System\nmlEgze.exe
  C:\Windows\System\nmlEgze.exe
  2⤵
  PID:1136
- C:\Windows\System\ncZAbSM.exe
  C:\Windows\System\ncZAbSM.exe
  2⤵
  PID:5096
- C:\Windows\System\Bvvkdlf.exe
  C:\Windows\System\Bvvkdlf.exe
  2⤵
  PID:5132
- C:\Windows\System\vPRoXjS.exe
  C:\Windows\System\vPRoXjS.exe
  2⤵
  PID:5148
- C:\Windows\System\sXbRrAp.exe
  C:\Windows\System\sXbRrAp.exe
  2⤵
  PID:5164
- C:\Windows\System\BMyLbqn.exe
  C:\Windows\System\BMyLbqn.exe
  2⤵
  PID:5180
- C:\Windows\System\ePCIlnM.exe
  C:\Windows\System\ePCIlnM.exe
  2⤵
  PID:5196
- C:\Windows\System\DCNeRMS.exe
  C:\Windows\System\DCNeRMS.exe
  2⤵
  PID:5212
- C:\Windows\System\cZWOLnm.exe
  C:\Windows\System\cZWOLnm.exe
  2⤵
  PID:5228
- C:\Windows\System\GGYQmEA.exe
  C:\Windows\System\GGYQmEA.exe
  2⤵
  PID:5244
- C:\Windows\System\pfOLRdV.exe
  C:\Windows\System\pfOLRdV.exe
  2⤵
  PID:5264
- C:\Windows\System\AoriTOL.exe
  C:\Windows\System\AoriTOL.exe
  2⤵
  PID:5284
- C:\Windows\System\jIvCCKn.exe
  C:\Windows\System\jIvCCKn.exe
  2⤵
  PID:5300
- C:\Windows\System\SAlAYkr.exe
  C:\Windows\System\SAlAYkr.exe
  2⤵
  PID:5316
- C:\Windows\System\iYROiWz.exe
  C:\Windows\System\iYROiWz.exe
  2⤵
  PID:5336
- C:\Windows\System\uIvelcW.exe
  C:\Windows\System\uIvelcW.exe
  2⤵
  PID:5352
- C:\Windows\System\RDhSWpt.exe
  C:\Windows\System\RDhSWpt.exe
  2⤵
  PID:5368
- C:\Windows\System\gVUHdKQ.exe
  C:\Windows\System\gVUHdKQ.exe
  2⤵
  PID:5384
- C:\Windows\System\sJrGYkw.exe
  C:\Windows\System\sJrGYkw.exe
  2⤵
  PID:5404
- C:\Windows\System\fwsYAuZ.exe
  C:\Windows\System\fwsYAuZ.exe
  2⤵
  PID:5424
- C:\Windows\System\uSRzQcN.exe
  C:\Windows\System\uSRzQcN.exe
  2⤵
  PID:5440
- C:\Windows\System\QCjvzPH.exe
  C:\Windows\System\QCjvzPH.exe
  2⤵
  PID:5456
- C:\Windows\System\wfEfSYs.exe
  C:\Windows\System\wfEfSYs.exe
  2⤵
  PID:5472
- C:\Windows\System\JUwwlgF.exe
  C:\Windows\System\JUwwlgF.exe
  2⤵
  PID:5488
- C:\Windows\System\qqnMzYC.exe
  C:\Windows\System\qqnMzYC.exe
  2⤵
  PID:5504
- C:\Windows\System\bnQQwNY.exe
  C:\Windows\System\bnQQwNY.exe
  2⤵
  PID:5520
- C:\Windows\System\GNizgUo.exe
  C:\Windows\System\GNizgUo.exe
  2⤵
  PID:5536
- C:\Windows\System\KGuGtiV.exe
  C:\Windows\System\KGuGtiV.exe
  2⤵
  PID:5552
- C:\Windows\System\OJjKkOc.exe
  C:\Windows\System\OJjKkOc.exe
  2⤵
  PID:5568
- C:\Windows\System\ilMxHVH.exe
  C:\Windows\System\ilMxHVH.exe
  2⤵
  PID:5584
- C:\Windows\System\fYKApUN.exe
  C:\Windows\System\fYKApUN.exe
  2⤵
  PID:5604
- C:\Windows\System\jxlaziW.exe
  C:\Windows\System\jxlaziW.exe
  2⤵
  PID:5620
- C:\Windows\System\xDHCotL.exe
  C:\Windows\System\xDHCotL.exe
  2⤵
  PID:5636
- C:\Windows\System\OFgQldg.exe
  C:\Windows\System\OFgQldg.exe
  2⤵
  PID:5652
- C:\Windows\System\QCfAiOS.exe
  C:\Windows\System\QCfAiOS.exe
  2⤵
  PID:5672
- C:\Windows\System\iooCNOl.exe
  C:\Windows\System\iooCNOl.exe
  2⤵
  PID:5692
- C:\Windows\System\SzxNnsH.exe
  C:\Windows\System\SzxNnsH.exe
  2⤵
  PID:5708
- C:\Windows\System\ZWsdVjz.exe
  C:\Windows\System\ZWsdVjz.exe
  2⤵
  PID:5732
- C:\Windows\System\SASuppj.exe
  C:\Windows\System\SASuppj.exe
  2⤵
  PID:5776
- C:\Windows\System\OtnnRrO.exe
  C:\Windows\System\OtnnRrO.exe
  2⤵
  PID:5828
- C:\Windows\System\jPeewUG.exe
  C:\Windows\System\jPeewUG.exe
  2⤵
  PID:5844
- C:\Windows\System\GJsHJlq.exe
  C:\Windows\System\GJsHJlq.exe
  2⤵
  PID:5860
- C:\Windows\System\QUVjzfe.exe
  C:\Windows\System\QUVjzfe.exe
  2⤵
  PID:5896
- C:\Windows\System\hPefhIE.exe
  C:\Windows\System\hPefhIE.exe
  2⤵
  PID:6004
- C:\Windows\System\xqRVXjo.exe
  C:\Windows\System\xqRVXjo.exe
  2⤵
  PID:6020
- C:\Windows\System\LtRXVqz.exe
  C:\Windows\System\LtRXVqz.exe
  2⤵
  PID:6036
- C:\Windows\System\Fcbechx.exe
  C:\Windows\System\Fcbechx.exe
  2⤵
  PID:6052
- C:\Windows\System\WXQwHPN.exe
  C:\Windows\System\WXQwHPN.exe
  2⤵
  PID:6068
- C:\Windows\System\HhshdnE.exe
  C:\Windows\System\HhshdnE.exe
  2⤵
  PID:6084
- C:\Windows\System\LHJNuIX.exe
  C:\Windows\System\LHJNuIX.exe
  2⤵
  PID:6100
- C:\Windows\System\kXjEZxx.exe
  C:\Windows\System\kXjEZxx.exe
  2⤵
  PID:1404
- C:\Windows\System\HqogBAJ.exe
  C:\Windows\System\HqogBAJ.exe
  2⤵
  PID:4304
- C:\Windows\System\CrAWlAS.exe
  C:\Windows\System\CrAWlAS.exe
  2⤵
  PID:1944
- C:\Windows\System\CvmiKoF.exe
  C:\Windows\System\CvmiKoF.exe
  2⤵
  PID:3064
- C:\Windows\System\BGBRqyW.exe
  C:\Windows\System\BGBRqyW.exe
  2⤵
  PID:2860
- C:\Windows\System\bjvbfdl.exe
  C:\Windows\System\bjvbfdl.exe
  2⤵
  PID:5172
- C:\Windows\System\HyzNdBH.exe
  C:\Windows\System\HyzNdBH.exe
  2⤵
  PID:5236
- C:\Windows\System\YGPQYAJ.exe
  C:\Windows\System\YGPQYAJ.exe
  2⤵
  PID:5308
- C:\Windows\System\mRifLae.exe
  C:\Windows\System\mRifLae.exe
  2⤵
  PID:4672
- C:\Windows\System\ITrvDFG.exe
  C:\Windows\System\ITrvDFG.exe
  2⤵
  PID:5412
- C:\Windows\System\aLDbjUE.exe
  C:\Windows\System\aLDbjUE.exe
  2⤵
  PID:5448
- C:\Windows\System\ZSAyEhV.exe
  C:\Windows\System\ZSAyEhV.exe
  2⤵
  PID:5512
- C:\Windows\System\CzejroV.exe
  C:\Windows\System\CzejroV.exe
  2⤵
  PID:5576
- C:\Windows\System\tQqmXfH.exe
  C:\Windows\System\tQqmXfH.exe
  2⤵
  PID:5644
- C:\Windows\System\XTcQrXO.exe
  C:\Windows\System\XTcQrXO.exe
  2⤵
  PID:4840
- C:\Windows\System\ukVjQtQ.exe
  C:\Windows\System\ukVjQtQ.exe
  2⤵
  PID:2668
- C:\Windows\System\jtOzOsD.exe
  C:\Windows\System\jtOzOsD.exe
  2⤵
  PID:1708
- C:\Windows\System\VHLckkB.exe
  C:\Windows\System\VHLckkB.exe
  2⤵
  PID:1920
- C:\Windows\System\BPbIOMU.exe
  C:\Windows\System\BPbIOMU.exe
  2⤵
  PID:5252
- C:\Windows\System\EsbHsni.exe
  C:\Windows\System\EsbHsni.exe
  2⤵
  PID:4716
- C:\Windows\System\mAcyLDn.exe
  C:\Windows\System\mAcyLDn.exe
  2⤵
  PID:5632
- C:\Windows\System\gANtKzS.exe
  C:\Windows\System\gANtKzS.exe
  2⤵
  PID:5224
- C:\Windows\System\jqSeIug.exe
  C:\Windows\System\jqSeIug.exe
  2⤵
  PID:5296
- C:\Windows\System\CUEeIvu.exe
  C:\Windows\System\CUEeIvu.exe
  2⤵
  PID:5396
- C:\Windows\System\pZsLTdZ.exe
  C:\Windows\System\pZsLTdZ.exe
  2⤵
  PID:5496
- C:\Windows\System\FUvMeBu.exe
  C:\Windows\System\FUvMeBu.exe
  2⤵
  PID:5600
- C:\Windows\System\dMAxpIF.exe
  C:\Windows\System\dMAxpIF.exe
  2⤵
  PID:876
- C:\Windows\System\ypxCqIC.exe
  C:\Windows\System\ypxCqIC.exe
  2⤵
  PID:1700
- C:\Windows\System\XaHUMWX.exe
  C:\Windows\System\XaHUMWX.exe
  2⤵
  PID:5704
- C:\Windows\System\qLHHdGJ.exe
  C:\Windows\System\qLHHdGJ.exe
  2⤵
  PID:5720
- C:\Windows\System\bXczVWi.exe
  C:\Windows\System\bXczVWi.exe
  2⤵
  PID:5788
- C:\Windows\System\xJYTuVr.exe
  C:\Windows\System\xJYTuVr.exe
  2⤵
  PID:5772
- C:\Windows\System\FPfGSew.exe
  C:\Windows\System\FPfGSew.exe
  2⤵
  PID:5756
- C:\Windows\System\NUsFzfy.exe
  C:\Windows\System\NUsFzfy.exe
  2⤵
  PID:5808
- C:\Windows\System\qpOrkFY.exe
  C:\Windows\System\qpOrkFY.exe
  2⤵
  PID:5872
- C:\Windows\System\IFcDAfY.exe
  C:\Windows\System\IFcDAfY.exe
  2⤵
  PID:5824
- C:\Windows\System\ThItSDP.exe
  C:\Windows\System\ThItSDP.exe
  2⤵
  PID:5888
- C:\Windows\System\VjhNpkK.exe
  C:\Windows\System\VjhNpkK.exe
  2⤵
  PID:5976
- C:\Windows\System\jgkOhpz.exe
  C:\Windows\System\jgkOhpz.exe
  2⤵
  PID:5944
- C:\Windows\System\AfPDFiy.exe
  C:\Windows\System\AfPDFiy.exe
  2⤵
  PID:5952
- C:\Windows\System\EyUSKTm.exe
  C:\Windows\System\EyUSKTm.exe
  2⤵
  PID:5980
- C:\Windows\System\QGJJHJq.exe
  C:\Windows\System\QGJJHJq.exe
  2⤵
  PID:5988
- C:\Windows\System\bSCfpty.exe
  C:\Windows\System\bSCfpty.exe
  2⤵
  PID:6012
- C:\Windows\System\fwfKorA.exe
  C:\Windows\System\fwfKorA.exe
  2⤵
  PID:6116
- C:\Windows\System\GvBQols.exe
  C:\Windows\System\GvBQols.exe
  2⤵
  PID:6044
- C:\Windows\System\QZMWaTu.exe
  C:\Windows\System\QZMWaTu.exe
  2⤵
  PID:6124
- C:\Windows\System\uJnHxRZ.exe
  C:\Windows\System\uJnHxRZ.exe
  2⤵
  PID:6140
- C:\Windows\System\GQecsPH.exe
  C:\Windows\System\GQecsPH.exe
  2⤵
  PID:6096
- C:\Windows\System\GmTEEHf.exe
  C:\Windows\System\GmTEEHf.exe
  2⤵
  PID:4192
- C:\Windows\System\TxxpkBt.exe
  C:\Windows\System\TxxpkBt.exe
  2⤵
  PID:5060
- C:\Windows\System\HxgrKXQ.exe
  C:\Windows\System\HxgrKXQ.exe
  2⤵
  PID:1240
- C:\Windows\System\FRfOAHJ.exe
  C:\Windows\System\FRfOAHJ.exe
  2⤵
  PID:2304
- C:\Windows\System\jWhlUhs.exe
  C:\Windows\System\jWhlUhs.exe
  2⤵
  PID:4804
- C:\Windows\System\oqkBMCW.exe
  C:\Windows\System\oqkBMCW.exe
  2⤵
  PID:2752
- C:\Windows\System\gJmQsRM.exe
  C:\Windows\System\gJmQsRM.exe
  2⤵
  PID:5376
- C:\Windows\System\MTDAGBj.exe
  C:\Windows\System\MTDAGBj.exe
  2⤵
  PID:2520
- C:\Windows\System\dZtAgjF.exe
  C:\Windows\System\dZtAgjF.exe
  2⤵
  PID:5380
- C:\Windows\System\uZTepCV.exe
  C:\Windows\System\uZTepCV.exe
  2⤵
  PID:5204
- C:\Windows\System\clAyUlh.exe
  C:\Windows\System\clAyUlh.exe
  2⤵
  PID:5124
- C:\Windows\System\zgKpkVk.exe
  C:\Windows\System\zgKpkVk.exe
  2⤵
  PID:5012
- C:\Windows\System\FKtiBuV.exe
  C:\Windows\System\FKtiBuV.exe
  2⤵
  PID:5144
- C:\Windows\System\qPthsPl.exe
  C:\Windows\System\qPthsPl.exe
  2⤵
  PID:5292
- C:\Windows\System\ZjowSPL.exe
  C:\Windows\System\ZjowSPL.exe
  2⤵
  PID:5464
- C:\Windows\System\cORKNmc.exe
  C:\Windows\System\cORKNmc.exe
  2⤵
  PID:5392
- C:\Windows\System\NKUksyB.exe
  C:\Windows\System\NKUksyB.exe
  2⤵
  PID:5596
- C:\Windows\System\cawLIzx.exe
  C:\Windows\System\cawLIzx.exe
  2⤵
  PID:5740
- C:\Windows\System\SUtSiqy.exe
  C:\Windows\System\SUtSiqy.exe
  2⤵
  PID:5804
- C:\Windows\System\XFJYxsV.exe
  C:\Windows\System\XFJYxsV.exe
  2⤵
  PID:5840
- C:\Windows\System\pCPDvBX.exe
  C:\Windows\System\pCPDvBX.exe
  2⤵
  PID:5868
- C:\Windows\System\kIjCllF.exe
  C:\Windows\System\kIjCllF.exe
  2⤵
  PID:5744
- C:\Windows\System\jBnGuzw.exe
  C:\Windows\System\jBnGuzw.exe
  2⤵
  PID:5820
- C:\Windows\System\DbZmvrs.exe
  C:\Windows\System\DbZmvrs.exe
  2⤵
  PID:5916
- C:\Windows\System\akSAIZo.exe
  C:\Windows\System\akSAIZo.exe
  2⤵
  PID:6028
- C:\Windows\System\iWMvPgB.exe
  C:\Windows\System\iWMvPgB.exe
  2⤵
  PID:2348
- C:\Windows\System\aWYmXAa.exe
  C:\Windows\System\aWYmXAa.exe
  2⤵
  PID:2832
- C:\Windows\System\aSjvCqn.exe
  C:\Windows\System\aSjvCqn.exe
  2⤵
  PID:5616
- C:\Windows\System\kmkmFLt.exe
  C:\Windows\System\kmkmFLt.exe
  2⤵
  PID:4632
- C:\Windows\System\tCSSnBE.exe
  C:\Windows\System\tCSSnBE.exe
  2⤵
  PID:4256
- C:\Windows\System\lXpOhqt.exe
  C:\Windows\System\lXpOhqt.exe
  2⤵
  PID:5260
- C:\Windows\System\XxjLJqt.exe
  C:\Windows\System\XxjLJqt.exe
  2⤵
  PID:2532
- C:\Windows\System\hXmCQXd.exe
  C:\Windows\System\hXmCQXd.exe
  2⤵
  PID:5968
- C:\Windows\System\ApwGfAR.exe
  C:\Windows\System\ApwGfAR.exe
  2⤵
  PID:6092
- C:\Windows\System\Chabzkm.exe
  C:\Windows\System\Chabzkm.exe
  2⤵
  PID:6032
- C:\Windows\System\dGEjZov.exe
  C:\Windows\System\dGEjZov.exe
  2⤵
  PID:5548
- C:\Windows\System\XFZtAWa.exe
  C:\Windows\System\XFZtAWa.exe
  2⤵
  PID:3252
- C:\Windows\System\TcRtEah.exe
  C:\Windows\System\TcRtEah.exe
  2⤵
  PID:5564
- C:\Windows\System\bzhjcMy.exe
  C:\Windows\System\bzhjcMy.exe
  2⤵
  PID:556
- C:\Windows\System\omqOwEL.exe
  C:\Windows\System\omqOwEL.exe
  2⤵
  PID:5420
- C:\Windows\System\YdbOiuf.exe
  C:\Windows\System\YdbOiuf.exe
  2⤵
  PID:2708
- C:\Windows\System\fhGovbR.exe
  C:\Windows\System\fhGovbR.exe
  2⤵
  PID:6148
- C:\Windows\System\aSZYAmo.exe
  C:\Windows\System\aSZYAmo.exe
  2⤵
  PID:6164
- C:\Windows\System\RViYZdU.exe
  C:\Windows\System\RViYZdU.exe
  2⤵
  PID:6180
- C:\Windows\System\GUoEdQD.exe
  C:\Windows\System\GUoEdQD.exe
  2⤵
  PID:6196
- C:\Windows\System\ZssUCJl.exe
  C:\Windows\System\ZssUCJl.exe
  2⤵
  PID:6212
- C:\Windows\System\CURbjxn.exe
  C:\Windows\System\CURbjxn.exe
  2⤵
  PID:6232
- C:\Windows\System\DyNFKnB.exe
  C:\Windows\System\DyNFKnB.exe
  2⤵
  PID:6252
- C:\Windows\System\ScIitNZ.exe
  C:\Windows\System\ScIitNZ.exe
  2⤵
  PID:6268
- C:\Windows\System\otTrRzH.exe
  C:\Windows\System\otTrRzH.exe
  2⤵
  PID:6288
- C:\Windows\System\mAbiSVB.exe
  C:\Windows\System\mAbiSVB.exe
  2⤵
  PID:6312
- C:\Windows\System\XOZTqbI.exe
  C:\Windows\System\XOZTqbI.exe
  2⤵
  PID:6328
- C:\Windows\System\MQSoYEO.exe
  C:\Windows\System\MQSoYEO.exe
  2⤵
  PID:6344
- C:\Windows\System\MrHKhwW.exe
  C:\Windows\System\MrHKhwW.exe
  2⤵
  PID:6360
- C:\Windows\System\RfYmlBQ.exe
  C:\Windows\System\RfYmlBQ.exe
  2⤵
  PID:6376
- C:\Windows\System\ypQgEjZ.exe
  C:\Windows\System\ypQgEjZ.exe
  2⤵
  PID:6392
- C:\Windows\System\sVPVlWr.exe
  C:\Windows\System\sVPVlWr.exe
  2⤵
  PID:6408
- C:\Windows\System\zzvHsEX.exe
  C:\Windows\System\zzvHsEX.exe
  2⤵
  PID:6424
- C:\Windows\System\UkVcTpz.exe
  C:\Windows\System\UkVcTpz.exe
  2⤵
  PID:6440
- C:\Windows\System\MVGqXKv.exe
  C:\Windows\System\MVGqXKv.exe
  2⤵
  PID:6456
- C:\Windows\System\nWmKGdD.exe
  C:\Windows\System\nWmKGdD.exe
  2⤵
  PID:6472
- C:\Windows\System\UYMeXLx.exe
  C:\Windows\System\UYMeXLx.exe
  2⤵
  PID:6488
- C:\Windows\System\okWhIri.exe
  C:\Windows\System\okWhIri.exe
  2⤵
  PID:6504
- C:\Windows\System\bntgibG.exe
  C:\Windows\System\bntgibG.exe
  2⤵
  PID:6520
- C:\Windows\System\bQqjXIv.exe
  C:\Windows\System\bQqjXIv.exe
  2⤵
  PID:6536
- C:\Windows\System\kbASDLd.exe
  C:\Windows\System\kbASDLd.exe
  2⤵
  PID:6552
- C:\Windows\System\oogqPua.exe
  C:\Windows\System\oogqPua.exe
  2⤵
  PID:6568
- C:\Windows\System\MXigolN.exe
  C:\Windows\System\MXigolN.exe
  2⤵
  PID:6588
- C:\Windows\System\ZWXaaLF.exe
  C:\Windows\System\ZWXaaLF.exe
  2⤵
  PID:6604
- C:\Windows\System\ZlWyZeA.exe
  C:\Windows\System\ZlWyZeA.exe
  2⤵
  PID:6620
- C:\Windows\System\nWwkXIy.exe
  C:\Windows\System\nWwkXIy.exe
  2⤵
  PID:6636
- C:\Windows\System\NFVDiTp.exe
  C:\Windows\System\NFVDiTp.exe
  2⤵
  PID:6652
- C:\Windows\System\mZNYJMy.exe
  C:\Windows\System\mZNYJMy.exe
  2⤵
  PID:6668
- C:\Windows\System\QcTTYXe.exe
  C:\Windows\System\QcTTYXe.exe
  2⤵
  PID:6780
- C:\Windows\System\fijWqYg.exe
  C:\Windows\System\fijWqYg.exe
  2⤵
  PID:6832
- C:\Windows\System\aGKvzcu.exe
  C:\Windows\System\aGKvzcu.exe
  2⤵
  PID:6900
- C:\Windows\System\uUJNuNO.exe
  C:\Windows\System\uUJNuNO.exe
  2⤵
  PID:6920
- C:\Windows\System\hWdWqAj.exe
  C:\Windows\System\hWdWqAj.exe
  2⤵
  PID:6940
- C:\Windows\System\IuSYZpq.exe
  C:\Windows\System\IuSYZpq.exe
  2⤵
  PID:6956
- C:\Windows\System\etMgjIs.exe
  C:\Windows\System\etMgjIs.exe
  2⤵
  PID:6972
- C:\Windows\System\IdAUIYc.exe
  C:\Windows\System\IdAUIYc.exe
  2⤵
  PID:6988
- C:\Windows\System\yHKQyoi.exe
  C:\Windows\System\yHKQyoi.exe
  2⤵
  PID:7004
- C:\Windows\System\qIyNUCk.exe
  C:\Windows\System\qIyNUCk.exe
  2⤵
  PID:7020
- C:\Windows\System\gBcpGFs.exe
  C:\Windows\System\gBcpGFs.exe
  2⤵
  PID:7036
- C:\Windows\System\mwKzjJU.exe
  C:\Windows\System\mwKzjJU.exe
  2⤵
  PID:7052
- C:\Windows\System\ZQmhlWE.exe
  C:\Windows\System\ZQmhlWE.exe
  2⤵
  PID:7068
- C:\Windows\System\HMGVeQR.exe
  C:\Windows\System\HMGVeQR.exe
  2⤵
  PID:7088
- C:\Windows\System\oUoViFX.exe
  C:\Windows\System\oUoViFX.exe
  2⤵
  PID:7104
- C:\Windows\System\wziVqJE.exe
  C:\Windows\System\wziVqJE.exe
  2⤵
  PID:7124
- C:\Windows\System\mdPtiiY.exe
  C:\Windows\System\mdPtiiY.exe
  2⤵
  PID:7140
- C:\Windows\System\QUpwnkp.exe
  C:\Windows\System\QUpwnkp.exe
  2⤵
  PID:7156
- C:\Windows\System\tBLspov.exe
  C:\Windows\System\tBLspov.exe
  2⤵
  PID:5908
- C:\Windows\System\XmcHKkw.exe
  C:\Windows\System\XmcHKkw.exe
  2⤵
  PID:5684
- C:\Windows\System\EmhmQMc.exe
  C:\Windows\System\EmhmQMc.exe
  2⤵
  PID:5628
- C:\Windows\System\HRJhDTs.exe
  C:\Windows\System\HRJhDTs.exe
  2⤵
  PID:3924
- C:\Windows\System\xGPIoOh.exe
  C:\Windows\System\xGPIoOh.exe
  2⤵
  PID:5760
- C:\Windows\System\dzVVDSd.exe
  C:\Windows\System\dzVVDSd.exe
  2⤵
  PID:5276
- C:\Windows\System\cPuNqHF.exe
  C:\Windows\System\cPuNqHF.exe
  2⤵
  PID:6264
- C:\Windows\System\jKylQOp.exe
  C:\Windows\System\jKylQOp.exe
  2⤵
  PID:6336
- C:\Windows\System\ZUBWUSO.exe
  C:\Windows\System\ZUBWUSO.exe
  2⤵
  PID:6300
- C:\Windows\System\uysuEHV.exe
  C:\Windows\System\uysuEHV.exe
  2⤵
  PID:5928
- C:\Windows\System\ujFAsGG.exe
  C:\Windows\System\ujFAsGG.exe
  2⤵
  PID:5156
- C:\Windows\System\ISmKbQA.exe
  C:\Windows\System\ISmKbQA.exe
  2⤵
  PID:6404
- C:\Windows\System\WsDkUHt.exe
  C:\Windows\System\WsDkUHt.exe
  2⤵
  PID:3844
- C:\Windows\System\SoZkKng.exe
  C:\Windows\System\SoZkKng.exe
  2⤵
  PID:2620
- C:\Windows\System\CSepkDc.exe
  C:\Windows\System\CSepkDc.exe
  2⤵
  PID:6204
- C:\Windows\System\GvCyhdD.exe
  C:\Windows\System\GvCyhdD.exe
  2⤵
  PID:6244
- C:\Windows\System\cYKRCPb.exe
  C:\Windows\System\cYKRCPb.exe
  2⤵
  PID:6284
- C:\Windows\System\dLrZBFk.exe
  C:\Windows\System\dLrZBFk.exe
  2⤵
  PID:6388
- C:\Windows\System\TURxsoY.exe
  C:\Windows\System\TURxsoY.exe
  2⤵
  PID:6448
- C:\Windows\System\qqnvUPN.exe
  C:\Windows\System\qqnvUPN.exe
  2⤵
  PID:6500
- C:\Windows\System\astYuEI.exe
  C:\Windows\System\astYuEI.exe
  2⤵
  PID:6564
- C:\Windows\System\ZABmupd.exe
  C:\Windows\System\ZABmupd.exe
  2⤵
  PID:6632
- C:\Windows\System\ByAGuZT.exe
  C:\Windows\System\ByAGuZT.exe
  2⤵
  PID:6616
- C:\Windows\System\FlzllHw.exe
  C:\Windows\System\FlzllHw.exe
  2⤵
  PID:6480
- C:\Windows\System\Gqempki.exe
  C:\Windows\System\Gqempki.exe
  2⤵
  PID:6740
- C:\Windows\System\WcywmMl.exe
  C:\Windows\System\WcywmMl.exe
  2⤵
  PID:6748
- C:\Windows\System\rbRDfNT.exe
  C:\Windows\System\rbRDfNT.exe
  2⤵
  PID:6764
- C:\Windows\System\pmtXdfu.exe
  C:\Windows\System\pmtXdfu.exe
  2⤵
  PID:6800
- C:\Windows\System\lObWWak.exe
  C:\Windows\System\lObWWak.exe
  2⤵
  PID:6816
- C:\Windows\System\IqdruqW.exe
  C:\Windows\System\IqdruqW.exe
  2⤵
  PID:6916
- C:\Windows\System\XYPJtRU.exe
  C:\Windows\System\XYPJtRU.exe
  2⤵
  PID:6892
- C:\Windows\System\ESsMKNO.exe
  C:\Windows\System\ESsMKNO.exe
  2⤵
  PID:6844
- C:\Windows\System\DqVPaes.exe
  C:\Windows\System\DqVPaes.exe
  2⤵
  PID:6868
- C:\Windows\System\ROuurgr.exe
  C:\Windows\System\ROuurgr.exe
  2⤵
  PID:6884
- C:\Windows\System\HyHyJJZ.exe
  C:\Windows\System\HyHyJJZ.exe
  2⤵
  PID:6968
- C:\Windows\System\nkednrk.exe
  C:\Windows\System\nkednrk.exe
  2⤵
  PID:7032
- C:\Windows\System\tTKvXLQ.exe
  C:\Windows\System\tTKvXLQ.exe
  2⤵
  PID:7100
- C:\Windows\System\DCiBnOA.exe
  C:\Windows\System\DCiBnOA.exe
  2⤵
  PID:5876
- C:\Windows\System\fdScGjh.exe
  C:\Windows\System\fdScGjh.exe
  2⤵
  PID:5664
- C:\Windows\System\rDMUZxT.exe
  C:\Windows\System\rDMUZxT.exe
  2⤵
  PID:6260
- C:\Windows\System\ycJlivr.exe
  C:\Windows\System\ycJlivr.exe
  2⤵
  PID:6368
- C:\Windows\System\UqXcUkG.exe
  C:\Windows\System\UqXcUkG.exe
  2⤵
  PID:6172
- C:\Windows\System\tUsHwSA.exe
  C:\Windows\System\tUsHwSA.exe
  2⤵
  PID:6320
- C:\Windows\System\mtwCWKx.exe
  C:\Windows\System\mtwCWKx.exe
  2⤵
  PID:6664
- C:\Windows\System\uokjZwn.exe
  C:\Windows\System\uokjZwn.exe
  2⤵
  PID:6484
- C:\Windows\System\GTWJkit.exe
  C:\Windows\System\GTWJkit.exe
  2⤵
  PID:6980
- C:\Windows\System\YEcZqDz.exe
  C:\Windows\System\YEcZqDz.exe
  2⤵
  PID:7044
- C:\Windows\System\dTWKxPZ.exe
  C:\Windows\System\dTWKxPZ.exe
  2⤵
  PID:7084
- C:\Windows\System\AauggMP.exe
  C:\Windows\System\AauggMP.exe
  2⤵
  PID:7148
- C:\Windows\System\EgydqUK.exe
  C:\Windows\System\EgydqUK.exe
  2⤵
  PID:6016
- C:\Windows\System\SfOehVj.exe
  C:\Windows\System\SfOehVj.exe
  2⤵
  PID:5716
- C:\Windows\System\peGlIvq.exe
  C:\Windows\System\peGlIvq.exe
  2⤵
  PID:5560
- C:\Windows\System\WZhAIMx.exe
  C:\Windows\System\WZhAIMx.exe
  2⤵
  PID:6136
- C:\Windows\System\beBsZel.exe
  C:\Windows\System\beBsZel.exe
  2⤵
  PID:6372
- C:\Windows\System\ZtGmmIT.exe
  C:\Windows\System\ZtGmmIT.exe
  2⤵
  PID:6248
- C:\Windows\System\seDIPlQ.exe
  C:\Windows\System\seDIPlQ.exe
  2⤵
  PID:6384
- C:\Windows\System\UojevKd.exe
  C:\Windows\System\UojevKd.exe
  2⤵
  PID:6628
- C:\Windows\System\NeTQqRp.exe
  C:\Windows\System\NeTQqRp.exe
  2⤵
  PID:6612
- C:\Windows\System\xfaclvo.exe
  C:\Windows\System\xfaclvo.exe
  2⤵
  PID:6584
- C:\Windows\System\ZXSRicm.exe
  C:\Windows\System\ZXSRicm.exe
  2⤵
  PID:6696
- C:\Windows\System\BXKmoOu.exe
  C:\Windows\System\BXKmoOu.exe
  2⤵
  PID:6732
- C:\Windows\System\KgrhBqh.exe
  C:\Windows\System\KgrhBqh.exe
  2⤵
  PID:6760
- C:\Windows\System\nBUQUuf.exe
  C:\Windows\System\nBUQUuf.exe
  2⤵
  PID:6912
- C:\Windows\System\OZeaBUT.exe
  C:\Windows\System\OZeaBUT.exe
  2⤵
  PID:6772
- C:\Windows\System\YriQNSy.exe
  C:\Windows\System\YriQNSy.exe
  2⤵
  PID:6876
- C:\Windows\System\ACvRnsL.exe
  C:\Windows\System\ACvRnsL.exe
  2⤵
  PID:1272
- C:\Windows\System\PhltucB.exe
  C:\Windows\System\PhltucB.exe
  2⤵
  PID:6804
- C:\Windows\System\frSWHfA.exe
  C:\Windows\System\frSWHfA.exe
  2⤵
  PID:7000
- C:\Windows\System\sMuAvRu.exe
  C:\Windows\System\sMuAvRu.exe
  2⤵
  PID:6228
- C:\Windows\System\tBNrovz.exe
  C:\Windows\System\tBNrovz.exe
  2⤵
  PID:5612
- C:\Windows\System\JWfmLlt.exe
  C:\Windows\System\JWfmLlt.exe
  2⤵
  PID:6220
- C:\Windows\System\yuumGkj.exe
  C:\Windows\System\yuumGkj.exe
  2⤵
  PID:6724
- C:\Windows\System\tzqtQcM.exe
  C:\Windows\System\tzqtQcM.exe
  2⤵
  PID:6712
- C:\Windows\System\GcZZvwM.exe
  C:\Windows\System\GcZZvwM.exe
  2⤵
  PID:6580
- C:\Windows\System\bcoeRuJ.exe
  C:\Windows\System\bcoeRuJ.exe
  2⤵
  PID:6808
- C:\Windows\System\CYdqhjP.exe
  C:\Windows\System\CYdqhjP.exe
  2⤵
  PID:6532
- C:\Windows\System\mIZPvhr.exe
  C:\Windows\System\mIZPvhr.exe
  2⤵
  PID:5360
- C:\Windows\System\IKgaPAG.exe
  C:\Windows\System\IKgaPAG.exe
  2⤵
  PID:6888
- C:\Windows\System\WEJgwfb.exe
  C:\Windows\System\WEJgwfb.exe
  2⤵
  PID:5984
- C:\Windows\System\ymjAjVT.exe
  C:\Windows\System\ymjAjVT.exe
  2⤵
  PID:6516
- C:\Windows\System\GqrOPxx.exe
  C:\Windows\System\GqrOPxx.exe
  2⤵
  PID:7016
- C:\Windows\System\aWEUotw.exe
  C:\Windows\System\aWEUotw.exe
  2⤵
  PID:6356
- C:\Windows\System\pCxFkst.exe
  C:\Windows\System\pCxFkst.exe
  2⤵
  PID:3648
- C:\Windows\System\HwgGJMi.exe
  C:\Windows\System\HwgGJMi.exe
  2⤵
  PID:6496
- C:\Windows\System\SWzckXv.exe
  C:\Windows\System\SWzckXv.exe
  2⤵
  PID:5048
- C:\Windows\System\fmZVAer.exe
  C:\Windows\System\fmZVAer.exe
  2⤵
  PID:6720
- C:\Windows\System\mUDEXbo.exe
  C:\Windows\System\mUDEXbo.exe
  2⤵
  PID:6776
- C:\Windows\System\TEAMcpN.exe
  C:\Windows\System\TEAMcpN.exe
  2⤵
  PID:7076
- C:\Windows\System\jUHxRSh.exe
  C:\Windows\System\jUHxRSh.exe
  2⤵
  PID:6280
- C:\Windows\System\hFZWvfU.exe
  C:\Windows\System\hFZWvfU.exe
  2⤵
  PID:6192
- C:\Windows\System\oNTAiDv.exe
  C:\Windows\System\oNTAiDv.exe
  2⤵
  PID:5784
- C:\Windows\System\FuVCQzn.exe
  C:\Windows\System\FuVCQzn.exe
  2⤵
  PID:1540
- C:\Windows\System\ZFMNEsX.exe
  C:\Windows\System\ZFMNEsX.exe
  2⤵
  PID:6796
- C:\Windows\System\TfYFLvT.exe
  C:\Windows\System\TfYFLvT.exe
  2⤵
  PID:6648
- C:\Windows\System\VfJKwpt.exe
  C:\Windows\System\VfJKwpt.exe
  2⤵
  PID:6160
- C:\Windows\System\rGcXSue.exe
  C:\Windows\System\rGcXSue.exe
  2⤵
  PID:6600
- C:\Windows\System\GFFTzGj.exe
  C:\Windows\System\GFFTzGj.exe
  2⤵
  PID:7172
- C:\Windows\System\MbjLzxW.exe
  C:\Windows\System\MbjLzxW.exe
  2⤵
  PID:7188
- C:\Windows\System\JabNcfk.exe
  C:\Windows\System\JabNcfk.exe
  2⤵
  PID:7204
- C:\Windows\System\swZTljh.exe
  C:\Windows\System\swZTljh.exe
  2⤵
  PID:7220
- C:\Windows\System\QDGjnUz.exe
  C:\Windows\System\QDGjnUz.exe
  2⤵
  PID:7236
- C:\Windows\System\GtSvXRX.exe
  C:\Windows\System\GtSvXRX.exe
  2⤵
  PID:7252
- C:\Windows\System\LwJcLyZ.exe
  C:\Windows\System\LwJcLyZ.exe
  2⤵
  PID:7268
- C:\Windows\System\CoAhsdm.exe
  C:\Windows\System\CoAhsdm.exe
  2⤵
  PID:7284
- C:\Windows\System\rHUBkaD.exe
  C:\Windows\System\rHUBkaD.exe
  2⤵
  PID:7300
- C:\Windows\System\EGhXBXn.exe
  C:\Windows\System\EGhXBXn.exe
  2⤵
  PID:7316
- C:\Windows\System\MYiPTHS.exe
  C:\Windows\System\MYiPTHS.exe
  2⤵
  PID:7332
- C:\Windows\System\zYaNICv.exe
  C:\Windows\System\zYaNICv.exe
  2⤵
  PID:7348
- C:\Windows\System\QohBIPx.exe
  C:\Windows\System\QohBIPx.exe
  2⤵
  PID:7364
- C:\Windows\System\QgakAEj.exe
  C:\Windows\System\QgakAEj.exe
  2⤵
  PID:7380
- C:\Windows\System\NMokoiU.exe
  C:\Windows\System\NMokoiU.exe
  2⤵
  PID:7396
- C:\Windows\System\eVOiqzc.exe
  C:\Windows\System\eVOiqzc.exe
  2⤵
  PID:7412
- C:\Windows\System\JAvRqVe.exe
  C:\Windows\System\JAvRqVe.exe
  2⤵
  PID:7448
- C:\Windows\System\vXqWUFj.exe
  C:\Windows\System\vXqWUFj.exe
  2⤵
  PID:7468
- C:\Windows\System\PnDGxzp.exe
  C:\Windows\System\PnDGxzp.exe
  2⤵
  PID:7488
- C:\Windows\System\jfUFCbK.exe
  C:\Windows\System\jfUFCbK.exe
  2⤵
  PID:7504
- C:\Windows\System\GGQBMKi.exe
  C:\Windows\System\GGQBMKi.exe
  2⤵
  PID:7520
- C:\Windows\System\VhWjDNs.exe
  C:\Windows\System\VhWjDNs.exe
  2⤵
  PID:7536
- C:\Windows\System\dLgquWQ.exe
  C:\Windows\System\dLgquWQ.exe
  2⤵
  PID:7556
- C:\Windows\System\WLACkKT.exe
  C:\Windows\System\WLACkKT.exe
  2⤵
  PID:7572
- C:\Windows\System\jyjmSMv.exe
  C:\Windows\System\jyjmSMv.exe
  2⤵
  PID:7588
- C:\Windows\System\gErzZna.exe
  C:\Windows\System\gErzZna.exe
  2⤵
  PID:7604
- C:\Windows\System\YZWbDlX.exe
  C:\Windows\System\YZWbDlX.exe
  2⤵
  PID:7620
- C:\Windows\System\ckFSguA.exe
  C:\Windows\System\ckFSguA.exe
  2⤵
  PID:7636
- C:\Windows\System\IhaIthV.exe
  C:\Windows\System\IhaIthV.exe
  2⤵
  PID:7652
- C:\Windows\System\CDHNRvR.exe
  C:\Windows\System\CDHNRvR.exe
  2⤵
  PID:7668
- C:\Windows\System\JtvNZBO.exe
  C:\Windows\System\JtvNZBO.exe
  2⤵
  PID:7684
- C:\Windows\System\ytwwPqr.exe
  C:\Windows\System\ytwwPqr.exe
  2⤵
  PID:7700
- C:\Windows\System\WHuHjAC.exe
  C:\Windows\System\WHuHjAC.exe
  2⤵
  PID:7716
- C:\Windows\System\pXvdrTL.exe
  C:\Windows\System\pXvdrTL.exe
  2⤵
  PID:7732
- C:\Windows\System\MWpsxMt.exe
  C:\Windows\System\MWpsxMt.exe
  2⤵
  PID:7748
- C:\Windows\System\Ypitbyk.exe
  C:\Windows\System\Ypitbyk.exe
  2⤵
  PID:7764
- C:\Windows\System\gjahBer.exe
  C:\Windows\System\gjahBer.exe
  2⤵
  PID:7780
- C:\Windows\System\ouNphss.exe
  C:\Windows\System\ouNphss.exe
  2⤵
  PID:7796
- C:\Windows\System\YtJNstZ.exe
  C:\Windows\System\YtJNstZ.exe
  2⤵
  PID:7832
- C:\Windows\System\YNagGyH.exe
  C:\Windows\System\YNagGyH.exe
  2⤵
  PID:7848
- C:\Windows\System\YiPzhbv.exe
  C:\Windows\System\YiPzhbv.exe
  2⤵
  PID:7864
- C:\Windows\System\HjwGZyf.exe
  C:\Windows\System\HjwGZyf.exe
  2⤵
  PID:7880
- C:\Windows\System\UwdtmnG.exe
  C:\Windows\System\UwdtmnG.exe
  2⤵
  PID:7896
- C:\Windows\System\ScKtilp.exe
  C:\Windows\System\ScKtilp.exe
  2⤵
  PID:7912
- C:\Windows\System\XAOEdaN.exe
  C:\Windows\System\XAOEdaN.exe
  2⤵
  PID:7936
- C:\Windows\System\MqqEqjr.exe
  C:\Windows\System\MqqEqjr.exe
  2⤵
  PID:7952
- C:\Windows\System\APldnAO.exe
  C:\Windows\System\APldnAO.exe
  2⤵
  PID:7968
- C:\Windows\System\kMtxqeB.exe
  C:\Windows\System\kMtxqeB.exe
  2⤵
  PID:7984
- C:\Windows\System\nlzDegx.exe
  C:\Windows\System\nlzDegx.exe
  2⤵
  PID:8000
- C:\Windows\System\snbkDTR.exe
  C:\Windows\System\snbkDTR.exe
  2⤵
  PID:8016
- C:\Windows\System\BwmNpUs.exe
  C:\Windows\System\BwmNpUs.exe
  2⤵
  PID:8032
- C:\Windows\System\tboGobk.exe
  C:\Windows\System\tboGobk.exe
  2⤵
  PID:8048
- C:\Windows\System\DhfLyVW.exe
  C:\Windows\System\DhfLyVW.exe
  2⤵
  PID:8064
- C:\Windows\System\ZPiQCXv.exe
  C:\Windows\System\ZPiQCXv.exe
  2⤵
  PID:8084
- C:\Windows\System\ZakLqOO.exe
  C:\Windows\System\ZakLqOO.exe
  2⤵
  PID:8100
- C:\Windows\System\weFyFAh.exe
  C:\Windows\System\weFyFAh.exe
  2⤵
  PID:8116
- C:\Windows\System\jpJnPoT.exe
  C:\Windows\System\jpJnPoT.exe
  2⤵
  PID:8136
- C:\Windows\System\hitaHgo.exe
  C:\Windows\System\hitaHgo.exe
  2⤵
  PID:8152
- C:\Windows\System\pmRMGJg.exe
  C:\Windows\System\pmRMGJg.exe
  2⤵
  PID:8168
- C:\Windows\System\TnyKCbk.exe
  C:\Windows\System\TnyKCbk.exe
  2⤵
  PID:8188
- C:\Windows\System\uwDzRYb.exe
  C:\Windows\System\uwDzRYb.exe
  2⤵
  PID:7232
- C:\Windows\System\KWujOFe.exe
  C:\Windows\System\KWujOFe.exe
  2⤵
  PID:6932
- C:\Windows\System\vtZPnTj.exe
  C:\Windows\System\vtZPnTj.exe
  2⤵
  PID:6952
- C:\Windows\System\SpPHcfV.exe
  C:\Windows\System\SpPHcfV.exe
  2⤵
  PID:7212
- C:\Windows\System\rCBqJvR.exe
  C:\Windows\System\rCBqJvR.exe
  2⤵
  PID:7292
- C:\Windows\System\IQjKeJi.exe
  C:\Windows\System\IQjKeJi.exe
  2⤵
  PID:7324
- C:\Windows\System\WprMoJQ.exe
  C:\Windows\System\WprMoJQ.exe
  2⤵
  PID:7360
- C:\Windows\System\hZinPhn.exe
  C:\Windows\System\hZinPhn.exe
  2⤵
  PID:7372
- C:\Windows\System\tIvFzly.exe
  C:\Windows\System\tIvFzly.exe
  2⤵
  PID:7444
- C:\Windows\System\xAGJWkd.exe
  C:\Windows\System\xAGJWkd.exe
  2⤵
  PID:7436
- C:\Windows\System\AgnxjHp.exe
  C:\Windows\System\AgnxjHp.exe
  2⤵
  PID:7464
- C:\Windows\System\gAISgSH.exe
  C:\Windows\System\gAISgSH.exe
  2⤵
  PID:7512
- C:\Windows\System\jswuYta.exe
  C:\Windows\System\jswuYta.exe
  2⤵
  PID:7552
- C:\Windows\System\uHlIgFV.exe
  C:\Windows\System\uHlIgFV.exe
  2⤵
  PID:7644
- C:\Windows\System\fkQXDQC.exe
  C:\Windows\System\fkQXDQC.exe
  2⤵
  PID:7568
- C:\Windows\System\xkSCFti.exe
  C:\Windows\System\xkSCFti.exe
  2⤵
  PID:7596
- C:\Windows\System\LQdRFRg.exe
  C:\Windows\System\LQdRFRg.exe
  2⤵
  PID:7660
- C:\Windows\System\qIDMVau.exe
  C:\Windows\System\qIDMVau.exe
  2⤵
  PID:7724
- C:\Windows\System\vdtaIjm.exe
  C:\Windows\System\vdtaIjm.exe
  2⤵
  PID:7712
- C:\Windows\System\ebtBjwi.exe
  C:\Windows\System\ebtBjwi.exe
  2⤵
  PID:7744
- C:\Windows\System\KZclxeT.exe
  C:\Windows\System\KZclxeT.exe
  2⤵
  PID:7816
- C:\Windows\System\cIxJaEb.exe
  C:\Windows\System\cIxJaEb.exe
  2⤵
  PID:7860
- C:\Windows\System\XVAOKaV.exe
  C:\Windows\System\XVAOKaV.exe
  2⤵
  PID:7892
- C:\Windows\System\tooBTVy.exe
  C:\Windows\System\tooBTVy.exe
  2⤵
  PID:7840
- C:\Windows\System\cHRszHP.exe
  C:\Windows\System\cHRszHP.exe
  2⤵
  PID:7928
- C:\Windows\System\OfjaqEB.exe
  C:\Windows\System\OfjaqEB.exe
  2⤵
  PID:7992
- C:\Windows\System\yGMIGPd.exe
  C:\Windows\System\yGMIGPd.exe
  2⤵
  PID:8056
- C:\Windows\System\uuREdLL.exe
  C:\Windows\System\uuREdLL.exe
  2⤵
  PID:7944
- C:\Windows\System\NqqnOmA.exe
  C:\Windows\System\NqqnOmA.exe
  2⤵
  PID:8012
- C:\Windows\System\xUAkCEE.exe
  C:\Windows\System\xUAkCEE.exe
  2⤵
  PID:7276
- C:\Windows\System\qlvUtzL.exe
  C:\Windows\System\qlvUtzL.exe
  2⤵
  PID:8080
- C:\Windows\System\tZVGWuN.exe
  C:\Windows\System\tZVGWuN.exe
  2⤵
  PID:8040
- C:\Windows\System\LlQMqDs.exe
  C:\Windows\System\LlQMqDs.exe
  2⤵
  PID:7976
- C:\Windows\System\ieUQqRQ.exe
  C:\Windows\System\ieUQqRQ.exe
  2⤵
  PID:7432
- C:\Windows\System\MOEsRba.exe
  C:\Windows\System\MOEsRba.exe
  2⤵
  PID:7328
- C:\Windows\System\KDNNfjJ.exe
  C:\Windows\System\KDNNfjJ.exe
  2⤵
  PID:7484
- C:\Windows\System\UydfNIs.exe
  C:\Windows\System\UydfNIs.exe
  2⤵
  PID:7788
- C:\Windows\System\MhufBYT.exe
  C:\Windows\System\MhufBYT.exe
  2⤵
  PID:7164
- C:\Windows\System\dHVHyVX.exe
  C:\Windows\System\dHVHyVX.exe
  2⤵
  PID:7408
- C:\Windows\System\iNsFRHY.exe
  C:\Windows\System\iNsFRHY.exe
  2⤵
  PID:7544
- C:\Windows\System\RONTxyQ.exe
  C:\Windows\System\RONTxyQ.exe
  2⤵
  PID:7628
- C:\Windows\System\hmJrYNn.exe
  C:\Windows\System\hmJrYNn.exe
  2⤵
  PID:7708
- C:\Windows\System\jJqJYIJ.exe
  C:\Windows\System\jJqJYIJ.exe
  2⤵
  PID:7920
- C:\Windows\System\CWuJLlR.exe
  C:\Windows\System\CWuJLlR.exe
  2⤵
  PID:8028
- C:\Windows\System\SXtFwLE.exe
  C:\Windows\System\SXtFwLE.exe
  2⤵
  PID:8184
- C:\Windows\System\lvBQzoH.exe
  C:\Windows\System\lvBQzoH.exe
  2⤵
  PID:7200
- C:\Windows\System\UnZDxdZ.exe
  C:\Windows\System\UnZDxdZ.exe
  2⤵
  PID:7280
- C:\Windows\System\GkRUDhk.exe
  C:\Windows\System\GkRUDhk.exe
  2⤵
  PID:7392
- C:\Windows\System\BQsTaxE.exe
  C:\Windows\System\BQsTaxE.exe
  2⤵
  PID:7312
- C:\Windows\System\sZxJdSZ.exe
  C:\Windows\System\sZxJdSZ.exe
  2⤵
  PID:7612
- C:\Windows\System\eWEjdRi.exe
  C:\Windows\System\eWEjdRi.exe
  2⤵
  PID:7872
- C:\Windows\System\KFKuajG.exe
  C:\Windows\System\KFKuajG.exe
  2⤵
  PID:7196
- C:\Windows\System\vocrRnD.exe
  C:\Windows\System\vocrRnD.exe
  2⤵
  PID:7616
- C:\Windows\System\ProisgK.exe
  C:\Windows\System\ProisgK.exe
  2⤵
  PID:8212
- C:\Windows\System\FkvJrFW.exe
  C:\Windows\System\FkvJrFW.exe
  2⤵
  PID:8228
- C:\Windows\System\ESVjnpq.exe
  C:\Windows\System\ESVjnpq.exe
  2⤵
  PID:8244
- C:\Windows\System\aoJTSBJ.exe
  C:\Windows\System\aoJTSBJ.exe
  2⤵
  PID:8268
- C:\Windows\System\mybnCVR.exe
  C:\Windows\System\mybnCVR.exe
  2⤵
  PID:8284
- C:\Windows\System\lFDLJxv.exe
  C:\Windows\System\lFDLJxv.exe
  2⤵
  PID:8304
- C:\Windows\System\ADbkvzu.exe
  C:\Windows\System\ADbkvzu.exe
  2⤵
  PID:8324
- C:\Windows\System\PdepFLf.exe
  C:\Windows\System\PdepFLf.exe
  2⤵
  PID:8348
- C:\Windows\System\HnYAuIX.exe
  C:\Windows\System\HnYAuIX.exe
  2⤵
  PID:8364
- C:\Windows\System\Ipnckww.exe
  C:\Windows\System\Ipnckww.exe
  2⤵
  PID:8380
- C:\Windows\System\mAiUTZG.exe
  C:\Windows\System\mAiUTZG.exe
  2⤵
  PID:8396
- C:\Windows\System\MQEhtfi.exe
  C:\Windows\System\MQEhtfi.exe
  2⤵
  PID:8428
- C:\Windows\System\bfVwOrn.exe
  C:\Windows\System\bfVwOrn.exe
  2⤵
  PID:8444
- C:\Windows\System\TdYzxkU.exe
  C:\Windows\System\TdYzxkU.exe
  2⤵
  PID:8460
- C:\Windows\System\nCKmmmO.exe
  C:\Windows\System\nCKmmmO.exe
  2⤵
  PID:8476
- C:\Windows\System\ILMxspw.exe
  C:\Windows\System\ILMxspw.exe
  2⤵
  PID:8492
- C:\Windows\System\tKwGwIi.exe
  C:\Windows\System\tKwGwIi.exe
  2⤵
  PID:8508
- C:\Windows\System\KPPCNED.exe
  C:\Windows\System\KPPCNED.exe
  2⤵
  PID:8524
- C:\Windows\System\wzwQLdt.exe
  C:\Windows\System\wzwQLdt.exe
  2⤵
  PID:8540
- C:\Windows\System\XOvINEF.exe
  C:\Windows\System\XOvINEF.exe
  2⤵
  PID:8556
- C:\Windows\System\mtOLZAd.exe
  C:\Windows\System\mtOLZAd.exe
  2⤵
  PID:8572
- C:\Windows\System\yUHkDDx.exe
  C:\Windows\System\yUHkDDx.exe
  2⤵
  PID:8588
- C:\Windows\System\tWtXSMK.exe
  C:\Windows\System\tWtXSMK.exe
  2⤵
  PID:8604
- C:\Windows\System\rxXyhRC.exe
  C:\Windows\System\rxXyhRC.exe
  2⤵
  PID:8620
- C:\Windows\System\AJDvLOe.exe
  C:\Windows\System\AJDvLOe.exe
  2⤵
  PID:8636
- C:\Windows\System\gCiPluk.exe
  C:\Windows\System\gCiPluk.exe
  2⤵
  PID:8652
- C:\Windows\System\YcsIEyA.exe
  C:\Windows\System\YcsIEyA.exe
  2⤵
  PID:8668
- C:\Windows\System\UZLmKKK.exe
  C:\Windows\System\UZLmKKK.exe
  2⤵
  PID:8692
- C:\Windows\System\oSEHPlE.exe
  C:\Windows\System\oSEHPlE.exe
  2⤵
  PID:8708
- C:\Windows\System\ubdxoqn.exe
  C:\Windows\System\ubdxoqn.exe
  2⤵
  PID:8724
- C:\Windows\System\pjAcmVl.exe
  C:\Windows\System\pjAcmVl.exe
  2⤵
  PID:8740
- C:\Windows\System\RtIJucG.exe
  C:\Windows\System\RtIJucG.exe
  2⤵
  PID:8756
- C:\Windows\System\tpVGYrY.exe
  C:\Windows\System\tpVGYrY.exe
  2⤵
  PID:8772
- C:\Windows\System\OeBhdJz.exe
  C:\Windows\System\OeBhdJz.exe
  2⤵
  PID:8788
- C:\Windows\System\RhKofCO.exe
  C:\Windows\System\RhKofCO.exe
  2⤵
  PID:8804
- C:\Windows\System\TMUBdXY.exe
  C:\Windows\System\TMUBdXY.exe
  2⤵
  PID:8820
- C:\Windows\System\noAAjYM.exe
  C:\Windows\System\noAAjYM.exe
  2⤵
  PID:8836
- C:\Windows\System\dteswze.exe
  C:\Windows\System\dteswze.exe
  2⤵
  PID:8852
- C:\Windows\System\iAiiAYa.exe
  C:\Windows\System\iAiiAYa.exe
  2⤵
  PID:8868
- C:\Windows\System\SByCPRs.exe
  C:\Windows\System\SByCPRs.exe
  2⤵
  PID:8884
- C:\Windows\System\TIoOjbt.exe
  C:\Windows\System\TIoOjbt.exe
  2⤵
  PID:8900
- C:\Windows\System\LkLmlDu.exe
  C:\Windows\System\LkLmlDu.exe
  2⤵
  PID:8916
- C:\Windows\System\KKkmbaH.exe
  C:\Windows\System\KKkmbaH.exe
  2⤵
  PID:8932
- C:\Windows\System\YJJGNrM.exe
  C:\Windows\System\YJJGNrM.exe
  2⤵
  PID:8948
- C:\Windows\System\ZLlrtLo.exe
  C:\Windows\System\ZLlrtLo.exe
  2⤵
  PID:8964
- C:\Windows\System\EwAspbq.exe
  C:\Windows\System\EwAspbq.exe
  2⤵
  PID:8980
- C:\Windows\System\JnHqwep.exe
  C:\Windows\System\JnHqwep.exe
  2⤵
  PID:8996
- C:\Windows\System\UURCJMh.exe
  C:\Windows\System\UURCJMh.exe
  2⤵
  PID:9012
- C:\Windows\System\YHzWXwG.exe
  C:\Windows\System\YHzWXwG.exe
  2⤵
  PID:9032
- C:\Windows\System\lRZlEPm.exe
  C:\Windows\System\lRZlEPm.exe
  2⤵
  PID:9048
- C:\Windows\System\JksvbfQ.exe
  C:\Windows\System\JksvbfQ.exe
  2⤵
  PID:9064
- C:\Windows\System\LWyHpwp.exe
  C:\Windows\System\LWyHpwp.exe
  2⤵
  PID:9080
- C:\Windows\System\ORdIIcb.exe
  C:\Windows\System\ORdIIcb.exe
  2⤵
  PID:9096
- C:\Windows\System\opRjnZR.exe
  C:\Windows\System\opRjnZR.exe
  2⤵
  PID:9112
- C:\Windows\System\qynNtZZ.exe
  C:\Windows\System\qynNtZZ.exe
  2⤵
  PID:9128
- C:\Windows\System\vCPDPPk.exe
  C:\Windows\System\vCPDPPk.exe
  2⤵
  PID:9144
- C:\Windows\System\kHQXvQO.exe
  C:\Windows\System\kHQXvQO.exe
  2⤵
  PID:9160
- C:\Windows\System\PNVAJzH.exe
  C:\Windows\System\PNVAJzH.exe
  2⤵
  PID:9176
- C:\Windows\System\QxrmScn.exe
  C:\Windows\System\QxrmScn.exe
  2⤵
  PID:9192
- C:\Windows\System\kSBjWva.exe
  C:\Windows\System\kSBjWva.exe
  2⤵
  PID:9208
- C:\Windows\System\KjgqOpS.exe
  C:\Windows\System\KjgqOpS.exe
  2⤵
  PID:8076
- C:\Windows\System\GmhLiES.exe
  C:\Windows\System\GmhLiES.exe
  2⤵
  PID:8220
- C:\Windows\System\mMMvbcU.exe
  C:\Windows\System\mMMvbcU.exe
  2⤵
  PID:7960
- C:\Windows\System\uxtDqIv.exe
  C:\Windows\System\uxtDqIv.exe
  2⤵
  PID:8332
- C:\Windows\System\rtbGxIu.exe
  C:\Windows\System\rtbGxIu.exe
  2⤵
  PID:8372
- C:\Windows\System\HSQYlXZ.exe
  C:\Windows\System\HSQYlXZ.exe
  2⤵
  PID:8296
- C:\Windows\System\NuILYZY.exe
  C:\Windows\System\NuILYZY.exe
  2⤵
  PID:8408
- C:\Windows\System\lQakqdo.exe
  C:\Windows\System\lQakqdo.exe
  2⤵
  PID:8176
- C:\Windows\System\xxsprLe.exe
  C:\Windows\System\xxsprLe.exe
  2⤵
  PID:8488
- C:\Windows\System\qtBeTSY.exe
  C:\Windows\System\qtBeTSY.exe
  2⤵
  PID:8200
- C:\Windows\System\QGcRrDO.exe
  C:\Windows\System\QGcRrDO.exe
  2⤵
  PID:8240
- C:\Windows\System\GXITVit.exe
  C:\Windows\System\GXITVit.exe
  2⤵
  PID:7924
- C:\Windows\System\NtFDtXv.exe
  C:\Windows\System\NtFDtXv.exe
  2⤵
  PID:8552
- C:\Windows\System\XLOnafO.exe
  C:\Windows\System\XLOnafO.exe
  2⤵
  PID:7404
- C:\Windows\System\WCAsQls.exe
  C:\Windows\System\WCAsQls.exe
  2⤵
  PID:7820
- C:\Windows\System\vwjqXJx.exe
  C:\Windows\System\vwjqXJx.exe
  2⤵
  PID:7460
- C:\Windows\System\nfApXWi.exe
  C:\Windows\System\nfApXWi.exe
  2⤵
  PID:8320
- C:\Windows\System\cpQAmIy.exe
  C:\Windows\System\cpQAmIy.exe
  2⤵
  PID:8360
- C:\Windows\System\kSuJOId.exe
  C:\Windows\System\kSuJOId.exe
  2⤵
  PID:8468
- C:\Windows\System\ABcEMja.exe
  C:\Windows\System\ABcEMja.exe
  2⤵
  PID:8204
- C:\Windows\System\LFcECNl.exe
  C:\Windows\System\LFcECNl.exe
  2⤵
  PID:8388
- C:\Windows\System\GfvcLgc.exe
  C:\Windows\System\GfvcLgc.exe
  2⤵
  PID:8440
- C:\Windows\System\MBRGSYP.exe
  C:\Windows\System\MBRGSYP.exe
  2⤵
  PID:8564
- C:\Windows\System\psBlfik.exe
  C:\Windows\System\psBlfik.exe
  2⤵
  PID:8644
- C:\Windows\System\Xtmghtf.exe
  C:\Windows\System\Xtmghtf.exe
  2⤵
  PID:8628
- C:\Windows\System\dlxBJeK.exe
  C:\Windows\System\dlxBJeK.exe
  2⤵
  PID:8660
- C:\Windows\System\FzFbACD.exe
  C:\Windows\System\FzFbACD.exe
  2⤵
  PID:8736
- C:\Windows\System\dcrVjWt.exe
  C:\Windows\System\dcrVjWt.exe
  2⤵
  PID:8720
- C:\Windows\System\oXMkVBk.exe
  C:\Windows\System\oXMkVBk.exe
  2⤵
  PID:8812
- C:\Windows\System\ZPleblt.exe
  C:\Windows\System\ZPleblt.exe
  2⤵
  PID:8880
- C:\Windows\System\MthIcLr.exe
  C:\Windows\System\MthIcLr.exe
  2⤵
  PID:8940
- C:\Windows\System\OSbtGlc.exe
  C:\Windows\System\OSbtGlc.exe
  2⤵
  PID:9004
- C:\Windows\System\InxKaxQ.exe
  C:\Windows\System\InxKaxQ.exe
  2⤵
  PID:9072
- C:\Windows\System\mdLdHZF.exe
  C:\Windows\System\mdLdHZF.exe
  2⤵
  PID:8892
- C:\Windows\System\vVIHKjL.exe
  C:\Windows\System\vVIHKjL.exe
  2⤵
  PID:9172
- C:\Windows\System\MktFvaD.exe
  C:\Windows\System\MktFvaD.exe
  2⤵
  PID:8992
- C:\Windows\System\wjPRQXJ.exe
  C:\Windows\System\wjPRQXJ.exe
  2⤵
  PID:8224
- C:\Windows\System\QOSwAdo.exe
  C:\Windows\System\QOSwAdo.exe
  2⤵
  PID:9056
- C:\Windows\System\KwvAeeK.exe
  C:\Windows\System\KwvAeeK.exe
  2⤵
  PID:9088
- C:\Windows\System\TjSUiCF.exe
  C:\Windows\System\TjSUiCF.exe
  2⤵
  PID:8864
- C:\Windows\System\WYBGcVG.exe
  C:\Windows\System\WYBGcVG.exe
  2⤵
  PID:8256
- C:\Windows\System\MRnFlhY.exe
  C:\Windows\System\MRnFlhY.exe
  2⤵
  PID:9156
- C:\Windows\System\BVIfovC.exe
  C:\Windows\System\BVIfovC.exe
  2⤵
  PID:8956
- C:\Windows\System\qzROKdF.exe
  C:\Windows\System\qzROKdF.exe
  2⤵
  PID:8404
- C:\Windows\System\awyCXBH.exe
  C:\Windows\System\awyCXBH.exe
  2⤵
  PID:7804
- C:\Windows\System\QxHHWaX.exe
  C:\Windows\System\QxHHWaX.exe
  2⤵
  PID:7828
- C:\Windows\System\kcZtWnd.exe
  C:\Windows\System\kcZtWnd.exe
  2⤵
  PID:8456
- C:\Windows\System\eWXtkir.exe
  C:\Windows\System\eWXtkir.exe
  2⤵
  PID:5884
- C:\Windows\System\LyuacSm.exe
  C:\Windows\System\LyuacSm.exe
  2⤵
  PID:8280
- C:\Windows\System\iulSnmt.exe
  C:\Windows\System\iulSnmt.exe
  2⤵
  PID:8060
- C:\Windows\System\vLESCxP.exe
  C:\Windows\System\vLESCxP.exe
  2⤵
  PID:8568
- C:\Windows\System\jMpAVYc.exe
  C:\Windows\System\jMpAVYc.exe
  2⤵
  PID:7500
- C:\Windows\System\lWBvwXS.exe
  C:\Windows\System\lWBvwXS.exe
  2⤵
  PID:8180
- C:\Windows\System\QjVrWdA.exe
  C:\Windows\System\QjVrWdA.exe
  2⤵
  PID:8612
- C:\Windows\System\WlKGItk.exe
  C:\Windows\System\WlKGItk.exe
  2⤵
  PID:8676
- C:\Windows\System\OTghJFf.exe
  C:\Windows\System\OTghJFf.exe
  2⤵
  PID:8716
- C:\Windows\System\vCBFZTq.exe
  C:\Windows\System\vCBFZTq.exe
  2⤵
  PID:8976
- C:\Windows\System\uCeSRJK.exe
  C:\Windows\System\uCeSRJK.exe
  2⤵
  PID:8700
- C:\Windows\System\eAnNQWj.exe
  C:\Windows\System\eAnNQWj.exe
  2⤵
  PID:8844
- C:\Windows\System\zFUkMUe.exe
  C:\Windows\System\zFUkMUe.exe
  2⤵
  PID:9168
- C:\Windows\System\kbtdfaC.exe
  C:\Windows\System\kbtdfaC.exe
  2⤵
  PID:8684
- C:\Windows\System\JNGdiiO.exe
  C:\Windows\System\JNGdiiO.exe
  2⤵
  PID:8828
- C:\Windows\System\eGypZSu.exe
  C:\Windows\System\eGypZSu.exe
  2⤵
  PID:9028
- C:\Windows\System\AzIJdQx.exe
  C:\Windows\System\AzIJdQx.exe
  2⤵
  PID:7980
- C:\Windows\System\cXLjgVl.exe
  C:\Windows\System\cXLjgVl.exe
  2⤵
  PID:8436
- C:\Windows\System\WHwkytl.exe
  C:\Windows\System\WHwkytl.exe
  2⤵
  PID:8600
- C:\Windows\System\WKlDyyJ.exe
  C:\Windows\System\WKlDyyJ.exe
  2⤵
  PID:9040
- C:\Windows\System\opODEox.exe
  C:\Windows\System\opODEox.exe
  2⤵
  PID:5936
- C:\Windows\System\IPxDBWP.exe
  C:\Windows\System\IPxDBWP.exe
  2⤵
  PID:8532
- C:\Windows\System\BblblJv.exe
  C:\Windows\System\BblblJv.exe
  2⤵
  PID:8504
- C:\Windows\System\CvKINxe.exe
  C:\Windows\System\CvKINxe.exe
  2⤵
  PID:7756
- C:\Windows\System\Sdgjheg.exe
  C:\Windows\System\Sdgjheg.exe
  2⤵
  PID:6716
- C:\Windows\System\YFaTGas.exe
  C:\Windows\System\YFaTGas.exe
  2⤵
  PID:8784
- C:\Windows\System\wZUdUeW.exe
  C:\Windows\System\wZUdUeW.exe
  2⤵
  PID:7908
- C:\Windows\System\WsKKPQb.exe
  C:\Windows\System\WsKKPQb.exe
  2⤵
  PID:8316
- C:\Windows\System\wcWwGum.exe
  C:\Windows\System\wcWwGum.exe
  2⤵
  PID:9104
- C:\Windows\System\dQgHiwG.exe
  C:\Windows\System\dQgHiwG.exe
  2⤵
  PID:8988
- C:\Windows\System\hgcexQm.exe
  C:\Windows\System\hgcexQm.exe
  2⤵
  PID:7824
- C:\Windows\System\bNAtLUC.exe
  C:\Windows\System\bNAtLUC.exe
  2⤵
  PID:8780
- C:\Windows\System\sJtouxN.exe
  C:\Windows\System\sJtouxN.exe
  2⤵
  PID:8148
- C:\Windows\System\zSTuths.exe
  C:\Windows\System\zSTuths.exe
  2⤵
  PID:8424
- C:\Windows\System\qFrfWOk.exe
  C:\Windows\System\qFrfWOk.exe
  2⤵
  PID:9188
- C:\Windows\System\vFufmoO.exe
  C:\Windows\System\vFufmoO.exe
  2⤵
  PID:8928
- C:\Windows\System\DDgLVyG.exe
  C:\Windows\System\DDgLVyG.exe
  2⤵
  PID:9224
- C:\Windows\System\jgWsCpB.exe
  C:\Windows\System\jgWsCpB.exe
  2⤵
  PID:9240
- C:\Windows\System\givSmlH.exe
  C:\Windows\System\givSmlH.exe
  2⤵
  PID:9256
- C:\Windows\System\wEobNSZ.exe
  C:\Windows\System\wEobNSZ.exe
  2⤵
  PID:9272
- C:\Windows\System\hLhgDCk.exe
  C:\Windows\System\hLhgDCk.exe
  2⤵
  PID:9288
- C:\Windows\System\yvqkeKf.exe
  C:\Windows\System\yvqkeKf.exe
  2⤵
  PID:9304
- C:\Windows\System\BOVXPfe.exe
  C:\Windows\System\BOVXPfe.exe
  2⤵
  PID:9320
- C:\Windows\System\MDpLEtG.exe
  C:\Windows\System\MDpLEtG.exe
  2⤵
  PID:9336
- C:\Windows\System\HlTECzq.exe
  C:\Windows\System\HlTECzq.exe
  2⤵
  PID:9352
- C:\Windows\System\FCWSDfx.exe
  C:\Windows\System\FCWSDfx.exe
  2⤵
  PID:9368
- C:\Windows\System\kSrpfUH.exe
  C:\Windows\System\kSrpfUH.exe
  2⤵
  PID:9384
- C:\Windows\System\mjraKeG.exe
  C:\Windows\System\mjraKeG.exe
  2⤵
  PID:9400
- C:\Windows\System\klBdQnf.exe
  C:\Windows\System\klBdQnf.exe
  2⤵
  PID:9416
- C:\Windows\System\HSKkfWW.exe
  C:\Windows\System\HSKkfWW.exe
  2⤵
  PID:9432
- C:\Windows\System\PELLApL.exe
  C:\Windows\System\PELLApL.exe
  2⤵
  PID:9448
- C:\Windows\System\ofAtPmq.exe
  C:\Windows\System\ofAtPmq.exe
  2⤵
  PID:9464
- C:\Windows\System\OdqUJNW.exe
  C:\Windows\System\OdqUJNW.exe
  2⤵
  PID:9480
- C:\Windows\System\PZctbTS.exe
  C:\Windows\System\PZctbTS.exe
  2⤵
  PID:9496
- C:\Windows\System\WFzjtiC.exe
  C:\Windows\System\WFzjtiC.exe
  2⤵
  PID:9512
- C:\Windows\System\Bzlydhi.exe
  C:\Windows\System\Bzlydhi.exe
  2⤵
  PID:9528
- C:\Windows\System\AahATrn.exe
  C:\Windows\System\AahATrn.exe
  2⤵
  PID:9544
- C:\Windows\System\ouiXvnh.exe
  C:\Windows\System\ouiXvnh.exe
  2⤵
  PID:9560
- C:\Windows\System\leZnWOZ.exe
  C:\Windows\System\leZnWOZ.exe
  2⤵
  PID:9576
- C:\Windows\System\HARQduF.exe
  C:\Windows\System\HARQduF.exe
  2⤵
  PID:9592
- C:\Windows\System\aDlVRes.exe
  C:\Windows\System\aDlVRes.exe
  2⤵
  PID:9608
- C:\Windows\System\KZWvKtx.exe
  C:\Windows\System\KZWvKtx.exe
  2⤵
  PID:9624
- C:\Windows\System\jZAosXS.exe
  C:\Windows\System\jZAosXS.exe
  2⤵
  PID:9640
- C:\Windows\System\MnERFYv.exe
  C:\Windows\System\MnERFYv.exe
  2⤵
  PID:9656
- C:\Windows\System\dHQSFUf.exe
  C:\Windows\System\dHQSFUf.exe
  2⤵
  PID:9672
- C:\Windows\System\IsXUFiP.exe
  C:\Windows\System\IsXUFiP.exe
  2⤵
  PID:9688
- C:\Windows\System\wRtuxgF.exe
  C:\Windows\System\wRtuxgF.exe
  2⤵
  PID:9704
- C:\Windows\System\MEWCetH.exe
  C:\Windows\System\MEWCetH.exe
  2⤵
  PID:9720
- C:\Windows\System\OXJPvlc.exe
  C:\Windows\System\OXJPvlc.exe
  2⤵
  PID:9736
- C:\Windows\System\ziKScUK.exe
  C:\Windows\System\ziKScUK.exe
  2⤵
  PID:9752
- C:\Windows\System\SbhVCEx.exe
  C:\Windows\System\SbhVCEx.exe
  2⤵
  PID:9768
- C:\Windows\System\XieLMqM.exe
  C:\Windows\System\XieLMqM.exe
  2⤵
  PID:9784
- C:\Windows\System\LQlhnhw.exe
  C:\Windows\System\LQlhnhw.exe
  2⤵
  PID:9800
- C:\Windows\System\OOxaDCr.exe
  C:\Windows\System\OOxaDCr.exe
  2⤵
  PID:9816
- C:\Windows\System\hAVzmoa.exe
  C:\Windows\System\hAVzmoa.exe
  2⤵
  PID:9832
- C:\Windows\System\FhktUDv.exe
  C:\Windows\System\FhktUDv.exe
  2⤵
  PID:9848
- C:\Windows\System\eNethSy.exe
  C:\Windows\System\eNethSy.exe
  2⤵
  PID:9864
- C:\Windows\System\yhNvxHm.exe
  C:\Windows\System\yhNvxHm.exe
  2⤵
  PID:9880
- C:\Windows\System\SneaRCg.exe
  C:\Windows\System\SneaRCg.exe
  2⤵
  PID:9896
- C:\Windows\System\aEkVvGp.exe
  C:\Windows\System\aEkVvGp.exe
  2⤵
  PID:9912
- C:\Windows\System\yChULnL.exe
  C:\Windows\System\yChULnL.exe
  2⤵
  PID:9928
- C:\Windows\System\ZmKLzeq.exe
  C:\Windows\System\ZmKLzeq.exe
  2⤵
  PID:9944
- C:\Windows\System\soRPSJR.exe
  C:\Windows\System\soRPSJR.exe
  2⤵
  PID:9960
- C:\Windows\System\RfXHZJk.exe
  C:\Windows\System\RfXHZJk.exe
  2⤵
  PID:9976
- C:\Windows\System\xAvqzWu.exe
  C:\Windows\System\xAvqzWu.exe
  2⤵
  PID:9992
- C:\Windows\System\WBsyrDo.exe
  C:\Windows\System\WBsyrDo.exe
  2⤵
  PID:10008
- C:\Windows\System\OjrVfUG.exe
  C:\Windows\System\OjrVfUG.exe
  2⤵
  PID:10024
- C:\Windows\System\lkWKNWk.exe
  C:\Windows\System\lkWKNWk.exe
  2⤵
  PID:10044
- C:\Windows\System\TiFkjTD.exe
  C:\Windows\System\TiFkjTD.exe
  2⤵
  PID:10060
- C:\Windows\System\mVvgViZ.exe
  C:\Windows\System\mVvgViZ.exe
  2⤵
  PID:10076
- C:\Windows\System\zeuHYMb.exe
  C:\Windows\System\zeuHYMb.exe
  2⤵
  PID:10092
- C:\Windows\System\ktTvolj.exe
  C:\Windows\System\ktTvolj.exe
  2⤵
  PID:10108
- C:\Windows\System\xIwhgvo.exe
  C:\Windows\System\xIwhgvo.exe
  2⤵
  PID:10124
- C:\Windows\System\JQlKToO.exe
  C:\Windows\System\JQlKToO.exe
  2⤵
  PID:10140
- C:\Windows\System\GLvhuMo.exe
  C:\Windows\System\GLvhuMo.exe
  2⤵
  PID:10156
- C:\Windows\System\RsykmKQ.exe
  C:\Windows\System\RsykmKQ.exe
  2⤵
  PID:10172
- C:\Windows\System\RHoMjkd.exe
  C:\Windows\System\RHoMjkd.exe
  2⤵
  PID:10188
- C:\Windows\System\yEKWQlX.exe
  C:\Windows\System\yEKWQlX.exe
  2⤵
  PID:10204
- C:\Windows\System\ZvnXNbt.exe
  C:\Windows\System\ZvnXNbt.exe
  2⤵
  PID:10220
- C:\Windows\System\qemZUQe.exe
  C:\Windows\System\qemZUQe.exe
  2⤵
  PID:10236
- C:\Windows\System\JHAhbOw.exe
  C:\Windows\System\JHAhbOw.exe
  2⤵
  PID:9252
- C:\Windows\System\fIaVSDO.exe
  C:\Windows\System\fIaVSDO.exe
  2⤵
  PID:9316
- C:\Windows\System\mrILfeY.exe
  C:\Windows\System\mrILfeY.exe
  2⤵
  PID:9380
- C:\Windows\System\iXCUjfc.exe
  C:\Windows\System\iXCUjfc.exe
  2⤵
  PID:9444
- C:\Windows\System\aSHUPlP.exe
  C:\Windows\System\aSHUPlP.exe
  2⤵
  PID:9232
- C:\Windows\System\xAztlMd.exe
  C:\Windows\System\xAztlMd.exe
  2⤵
  PID:9300
- C:\Windows\System\rQjPMPD.exe
  C:\Windows\System\rQjPMPD.exe
  2⤵
  PID:9508
- C:\Windows\System\TVmrQEf.exe
  C:\Windows\System\TVmrQEf.exe
  2⤵
  PID:9572
- C:\Windows\System\ohTTqFh.exe
  C:\Windows\System\ohTTqFh.exe
  2⤵
  PID:9632
- C:\Windows\System\rOvifHX.exe
  C:\Windows\System\rOvifHX.exe
  2⤵
  PID:9664
- C:\Windows\System\rQKYIAg.exe
  C:\Windows\System\rQKYIAg.exe
  2⤵
  PID:9268
- C:\Windows\System\MZUeLvh.exe
  C:\Windows\System\MZUeLvh.exe
  2⤵
  PID:9492
- C:\Windows\System\YPVYysW.exe
  C:\Windows\System\YPVYysW.exe
  2⤵
  PID:9520
- C:\Windows\System\egvuoHm.exe
  C:\Windows\System\egvuoHm.exe
  2⤵
  PID:9620
- C:\Windows\System\hzyLZFV.exe
  C:\Windows\System\hzyLZFV.exe
  2⤵
  PID:9552
- C:\Windows\System\lOoTtho.exe
  C:\Windows\System\lOoTtho.exe
  2⤵
  PID:9648
- C:\Windows\System\jBjPFdU.exe
  C:\Windows\System\jBjPFdU.exe
  2⤵
  PID:9764
- C:\Windows\System\AQmeChL.exe
  C:\Windows\System\AQmeChL.exe
  2⤵
  PID:9824
- C:\Windows\System\eORZznv.exe
  C:\Windows\System\eORZznv.exe
  2⤵
  PID:9856
- C:\Windows\System\kCiROKa.exe
  C:\Windows\System\kCiROKa.exe
  2⤵
  PID:9892
- C:\Windows\System\jFDlyWo.exe
  C:\Windows\System\jFDlyWo.exe
  2⤵
  PID:9952
- C:\Windows\System\iOElLEP.exe
  C:\Windows\System\iOElLEP.exe
  2⤵
  PID:9988
- C:\Windows\System\PvWAlGX.exe
  C:\Windows\System\PvWAlGX.exe
  2⤵
  PID:9908
- C:\Windows\System\wSzQLlm.exe
  C:\Windows\System\wSzQLlm.exe
  2⤵
  PID:9968
- C:\Windows\System\IKpnGnV.exe
  C:\Windows\System\IKpnGnV.exe
  2⤵
  PID:10084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ArDhryl.exe

Filesize
2.2MB

MD5
d62aec0bc596ce3f211b78da636b5f08

SHA1
b9b6e71229655af5a62d134a1821849fd2f17d70

SHA256
3fc3eb878ee9f70af7e4bf1eaaf7d5500de3b52b722e321d3616d98365236d8c

SHA512
867672ce5288b47d1010598ae75f9290177d0a6f215790cf1633c2dfdc1313771a1e59b8a43ab654bf448765cab3aa2e933682f6163de7a05722aadc6b205af1

Download Submit
C:\Windows\system\BVsubiR.exe

Filesize
2.2MB

MD5
34b56594d20413a03a644aa31a17f0aa

SHA1
78a1aeb30141b785b20d43855aefe99f9b7bb2e5

SHA256
660da60e8900e0b3780bd16b5bf351bfbf2e237cf7991ade613036200f192ab8

SHA512
603016e3cb905afcdd1a546eb81714b8e24b1a23068a34adcedc60a118188e3b0d84b2bd59477e0576be833ea4cbb786ab75f9f3d17a6f9777eb43131fe6702f

Download Submit
C:\Windows\system\FLZVBQy.exe

Filesize
2.2MB

MD5
677444ccb640b861b91c7d40bda7d6a1

SHA1
fb8631e676943e173cc3a2cca9b6e679323beba3

SHA256
915c457b2962798b56f05e375f0b0d55ccccd4783d2e368ae0beffa120bb0867

SHA512
57423c209cd69ee82cec410a60aa8ae6b41ce77fa3a939a8835e91aca5ee037e47e921549bd2c8c0be7fea593fe92b8ac182e65d761c0aee91ed91280ea8ba9c

Download Submit
C:\Windows\system\HqLCwhm.exe

Filesize
2.2MB

MD5
2ebcb672e39d45cb2ce15df474f54da7

SHA1
da25ef7d3ea838ae9c1c969677fad58b1fa68530

SHA256
11e8648438c6cd43b66db12ab40763b974f244d9ce9e61ce6fcfd16391400fe9

SHA512
19ba98bb8f3cd78751fdf2f3e0b01fb3fcdaae8e3c003210d8d1c2b7a21ad4bb9594c56ad4e6778ff4b06222e027f955d5cf1921021b8482af9bf13fa1223d68

Download Submit
C:\Windows\system\NygXXJg.exe

Filesize
2.2MB

MD5
58972afb6a68636b086462da2aabaa3e

SHA1
b4f6ee12c00c25a71fee25e1b96e08f929d03d2a

SHA256
d6c882277554add544cfa2169ab22431cf872a7029290c8941b5a3d09d01c6bd

SHA512
a6facb23c6e50b67ed43c09fa319be9c0a72c78054534ea16453f744d4563953bef4025f34361a6c7e1a42859ad68dffd4901eb976dec84dd777a477064420cf

Download Submit
C:\Windows\system\PcsWKsK.exe

Filesize
2.2MB

MD5
14618e8107d75a3e4812a0a12dc2503c

SHA1
f8983a50b38dfab314e745be75051ed680958e13

SHA256
d656248b45c73b44b232adab58b83df672ce15c56072505c84cbbc0b51577c18

SHA512
51e5ffb7ccc41b703d115cfc5cb7418bde43c1b8fda7e8334979a390ee787b67e4dc58d1a33ec1592c20da4fc51e9f075d89cacc7c6fb5eb6e3005130dba1633

Download Submit
C:\Windows\system\QADXdts.exe

Filesize
2.2MB

MD5
d50f508e3ba4c1433f100f299fb1e301

SHA1
f5fe93a3dbca693976c0a6f66493fa468df25437

SHA256
32e3504b966df967cfe9f84605aaca6796a54d6446e687d12de09dd9594e11c0

SHA512
0bedcb4dc3630015d870930cc5104fa2ec87cebdbb348bbfe78def6e3f04e43a744e627af5b1eae739ef6d37259dea1c330a27bbb5db85dc1f91a1d3aa8e815a

Download Submit
C:\Windows\system\QGEQONg.exe

Filesize
2.2MB

MD5
edd97199382e8353ffda8634397e6ab0

SHA1
308fb14998672830a827d8608d7387c84d0a5036

SHA256
eccf5413fbedee31f999b869307500fae36402630103645b8ff139a79801c5b8

SHA512
c5fd9bd798c5c05bc1ad0006d874286b643381e1f8691bacdac85e0dec487db8e0df306db4d507f2e9c049b431f2fd1d27f5801261dc1b2196aa6f0365f1fd83

Download Submit
C:\Windows\system\WOKfeIP.exe

Filesize
2.2MB

MD5
cb2b6b9cbafb7414d01331d9784ed21b

SHA1
48baa63a6b79f8325110a573bb5ee772effdcc52

SHA256
9809be280cc629ac59819bc30463fdd5cba09fceb65f3cbb7eee4ee78178fa8d

SHA512
5a472f38cff16eac74353f1cd5639632e4b1e0a0db52ac2b7773592f527cb696609e1e09e4b0c93ee6b36c7c99518b8aad076bc271883e1286a9ce81c6b79316

Download Submit
C:\Windows\system\XVHwyKo.exe

Filesize
2.2MB

MD5
d8a853ef26164c905028ea445d207464

SHA1
dcfd2228602efef20b977918fb88321276bf6a3c

SHA256
07347bdad962b2f007686221063dfc706a1335735aaf9ea27e89f9f50f7131ae

SHA512
a4f736940de26785016176846b4fcdc4b0b85ca556ccff90fcbde91e02c91c895e8439dc34773f3dca66534a22c06771ac02161010f5d3fb3a5ad65f1856fa74

Download Submit
C:\Windows\system\YfgBJoJ.exe

Filesize
2.2MB

MD5
7b78fe6bed82e695df92c7f91fbf946b

SHA1
73d2194020cf861e56c4d03cd50604233257fe76

SHA256
20ba77bf315af01aef182f04dff996d0f66d907baa394f4ddceed9a8f41a54fa

SHA512
5b0c5a82e113630166c07dfccdfe0b453268406e6a7ae9462f51d74f3cc0adf86c00d8f60866e26cd74029301cbf721bd7cdd07cafc1bae64f47da727bae5889

Download Submit
C:\Windows\system\ZTRCogl.exe

Filesize
2.2MB

MD5
230765d699a5c17ed343e82363558199

SHA1
d3f225afdece03e106cec0fea41ef69cd52ce294

SHA256
5a3462dc62901d64e10f23cdb220a5b9cb4c12264a8248e0f1cf1bd09f3e3e83

SHA512
2548f95795b4685dd626304d8616d394affc40ba5e406282e8a3cff08d42d5f306417c09a98ed9cc346849678d2086572aea2ec78e53f9dec1d691a70ed05758

Download Submit
C:\Windows\system\aYYCnOa.exe

Filesize
2.2MB

MD5
a1eee1d457eb98c104bbb920a03df5ed

SHA1
82702ca8ad6fe7a00bb8a3f5f8a63f4c4a7a6de6

SHA256
ea4e401b77c03957a142e9b504aa9a4e59488e0299a876db125fc7b4d04a7a22

SHA512
cd8af6488323d273c99d8af97dc092c0d6728f26ed1d67ce824487e207a7b5bef9e9f9c19dafc52792e494fc1713d86b7bcfb3926cfc82d9f9c4d799fa1b9f32

Download Submit
C:\Windows\system\cXMJbOy.exe

Filesize
2.2MB

MD5
528a80d60a0fb4cc7a6c250451c3f5cc

SHA1
6b5c07e4666bc07fb4f654af0509dc5f05596bf2

SHA256
83d94efc8fde785da06e5fb5e4101bafb382d6fe21333165c65a7537549e843f

SHA512
cd9d0ebfb804bdc46934322ccd03aca539ce9925ea375c9461244504d476429142684363175c7a46a184a6b936e38d508ee98f00ca538331bf5ce3ca661c1883

Download Submit
C:\Windows\system\dmLncfr.exe

Filesize
2.2MB

MD5
3fdcaef920708e8b3c6c66f3b0903ac7

SHA1
f3413d90d74df68031fabf2362a51caabbfa8f12

SHA256
ffd0fdfbd610443e72f406dfce5935ab20e01c74364c12c8f01078b3d70604bb

SHA512
0edf1b0a7ba4cb6af449ab755f7cbe797be752077bb1807b93f872bd3b86aa2128e13855eb608535f6c936d872815859b8277fe4d609e59348944b31e984f09f

Download Submit
C:\Windows\system\fXVotNX.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\system\gAlGvxz.exe

Filesize
2.2MB

MD5
269d66b618532b64bf3b599e9cde0460

SHA1
abfc6dc5d9413e426d705c46bdb2443b51eb9fff

SHA256
7b01de4b768ebbe01eaf9592b1ce3db80d41296d6d967edf583353a338ad194d

SHA512
0447e5e7249a9ff7ad5278951e2ba7d4b99af36747c64f5c69ccde4b9a0b61522d9c68be0aa63483ff975340c63b669e84d074be0c834ad7653ef8e27b0ccd39

Download Submit
C:\Windows\system\iOmyGkm.exe

Filesize
2.2MB

MD5
044193f444a642fe77aa8dc1f89abaa4

SHA1
066c6899795cafdbaf33c091a760b75c5dd844a4

SHA256
894300cb620a2fc3e766c4a9cd62614cf2aa4b6332380d5e6c26cd3d8e9f69bd

SHA512
06c09fda430e78de0deab66b51024c685dcec87f9b18e5d8aeb2f8d4187d1385a4b11dbcf42c698370525d0fa9e993ad19e7ef5a8fd5e490149f73abb9d81857

Download Submit
C:\Windows\system\ieMBwwS.exe

Filesize
2.2MB

MD5
b517ae12fb294b2e2ec42a706b03048c

SHA1
a5473e89aaf2a4eb1734fb8865fd9a62fdbe9cef

SHA256
15943642f62170ae9971d601759374d0e6afa5705d7f64f4e1e6bae2a5c94831

SHA512
c9fb6385a9490d7e0a3225ef92e2d1255a3c831f0b2611c23e7b1ca3bc9377c6a5e261dc230790bd43573eb4aba745207586b3a8090a7df94ffc6d42cc498d79

Download Submit
C:\Windows\system\jfVinof.exe

Filesize
2.2MB

MD5
1f1aa97b6dd909370206c54180d0226f

SHA1
2be7dbffb1a52bd88462b6f3f511530585f5a58e

SHA256
7def6621964eac51b763b448d03c1eb0cdf5029a04ca498bb334d56e9b16fcba

SHA512
ba3777cb87f12e19d1d9642f8aa7f833931559cb1e8372fa67401e82023c643daaa29cc7f316d2610d8281350b743ab2407b3631dc3afd92458c342f2ac4313b

Download Submit
C:\Windows\system\rHyDcua.exe

Filesize
2.2MB

MD5
23447dbd46b2e59dbfbe968a1d312574

SHA1
1abfdc2da81e2f0b2c6e0b0bd95917d9a5770982

SHA256
8167b16307e40af695add3094450516d33a43c2622b45db1c9e4ba2473716604

SHA512
16b9f3a882fb181f8641b534ec94da9c58f35831e40433c2a374045fb4d072180a495e8e81019cf21dd54d0603120f3d7a72e6bc1d03405e9d9aaaa6819f038c

Download Submit
C:\Windows\system\rzKLXKb.exe

Filesize
2.2MB

MD5
68256bc7321e56fdb0e835875b74e4a0

SHA1
fd461da3765a4f106ddbd0d93a46ee58aecbd74a

SHA256
c7fa6eea9028a2e497449684fb62dab82f5fb560a84a34b128cf8a1939914be5

SHA512
06bcaf3b88d6aa0bb787022794faf04b3a169895cc21ffa3fd64198bdd43710d66eeae608186a575253a0cd612001fc230a87b47632210f80876e93d7f8181c1

Download Submit
C:\Windows\system\uksErIj.exe

Filesize
2.2MB

MD5
ff9cf6e5e0cea676c597dbcc6edc2966

SHA1
b3cfb4fd2353ff2acd745c2e69768700ce5bdf21

SHA256
424440dc5ef2173d653725573d10d688543f59215a7747283192c536ed084c99

SHA512
c4c3cacafb6f423253e30b5490d33d682b12533ab23cbeb9c1f57fc2b745c79530e18f79140cdeb3fa562ae14a27cf7d3774c863898cbbe0672367bc70defc85

Download Submit
C:\Windows\system\vtFAEWb.exe

Filesize
2.2MB

MD5
810982d0b3881e676b01652bc5bd34bb

SHA1
3fe8230e0e814ce4412d68742fbd02b0b45c9b09

SHA256
6584534c1258890c2594c392b1c3e88acb62156d6b2c807e849eb8fd1d6cdb5f

SHA512
fe6467521975d20e6ebfecf62d697a6bb9b718f3610159c773b09a01b3776a1c82591d3fff8490c85919ecc6ee53c1203b5b026c6da4d352d2c54f081495e73a

Download Submit
C:\Windows\system\wOwgLmE.exe

Filesize
2.2MB

MD5
61de94a066458596009ade7926039ebb

SHA1
4242b226e35bd9ef86526b2070874ef951ba866d

SHA256
b4d8710c4a9f65cb2d26eb22ef3bdafabeb8d8fcb5425e22b983c3a4921a0db2

SHA512
3c230cadeaf8e1a1badd60d051be076d77cd9c87b507f423e799f9f6cdfd03ffcfb7158882c6728c0e1bfa9c4dd5d27da479d47bd619771b700fc9f4b3503818

Download Submit
C:\Windows\system\xxNHnzL.exe

Filesize
2.2MB

MD5
272da0f4ac953a5b3077898b7d393e73

SHA1
01d93fc0236b7ee4e4fade990e14691fe22d9128

SHA256
cc5a515a28bd6d06948c5ce74c4c75460fbcc9685b57f67664116effb62f3a0f

SHA512
e7dc9ecafa4dc72a3d907bf0a22c0cf58fd59854e6326c0ec35e8a77e347a6184444e83561b899845ad4eb168f9992fa2af491ccf806eda7bf1ec527bca87474

Download Submit
C:\Windows\system\ycBEltk.exe

Filesize
2.2MB

MD5
8eaa82c511121a671bf3e7a6fc02e333

SHA1
f8ad4cd918e34e89235ccaa4d48629ba09a0a2a6

SHA256
099d1d693160d7c6a226868280de9eadae70da6582735ee91432a30b38044f32

SHA512
2b342d0f6489a1f75e11d31b5fcef9abbc31d742abe353ee07cc5068afa416603dd0b90b090ba1f2d5328132281d481a9fb9e627418c95f36ac68a01cdaaa56f

Download Submit
C:\Windows\system\zwGrAvt.exe

Filesize
2.2MB

MD5
5e8644b0c12742b2f28c605064db60a6

SHA1
9bee1ff9d6e5dd36ed96ab196d175711eb65bbbc

SHA256
6907c3d1d5ba43a1cba1cd9ccc133f017b8061f93af6e35816a6c23abda7e310

SHA512
3c85166fd46b4180deecbbe20d0ad267d9218601f62ef8ec5b03a095f13b310884629bba68c358e3fea93dc04d7c1096ae27b6d2c3cd960f98851bc0e0fe3482

Download Submit
\Windows\system\NBrnBzx.exe

Filesize
2.2MB

MD5
f5c2b08553e52035ca23a6b6e3a7125c

SHA1
f51dd12fa295b2edb71d527dcdebc516ab3ba556

SHA256
456d81e28d415814b97099696bac5494a5b9254813f48fdc386199e3967a604d

SHA512
ba6fe526bd924e7eae06e9006522ccb800ad2c85db5771eb35664765686d8f503647e058d1e0dc1be9605a756c5ec979462c319cd4d06da4bee01fe1167d5c45

Download Submit
\Windows\system\Omgcxiz.exe

Filesize
2.2MB

MD5
fd25405642b57dfe5c19903e14a9183a

SHA1
e9207d03e7739b59d9c9384aa27b59a8e90e714b

SHA256
ea1157cc069e30d9e68e446681e6d9fd297ef42031a925934009b68c6c8b4642

SHA512
d4cef75abfba8c212adaf957141e64a0dc7ff26e1ca52b137df48bdb8f45807685015e8ccd1ae042c138d035eb6119ffb43634d51484b318cf58985e138832aa

Download Submit
\Windows\system\QvoUBAK.exe

Filesize
2.2MB

MD5
df76384802a085e9c92e8ba3f65a73e7

SHA1
ccc73ddd3092e6c11c92b95a2de3c2ed5e914ffb

SHA256
92bf26f3b635f524fa216f043e296e2a5458e54425a3b5e8fec3fbe81b91c89d

SHA512
3cf1f71e21030090b9e3c13016a6a44b8347e393aef2efaf7a9a078952ea6c0900ea3737a5c9f9c7caba2dc78acb8641066ef1e96f1d8aeb039c9eeebbbac1cd

Download Submit
\Windows\system\evKZYmx.exe

Filesize
2.2MB

MD5
744ff57a81d2ac1546372f4765c68ad6

SHA1
1ece393c2a0cf9c1c9bd50fa25c4bf194bd60df7

SHA256
310c931787867d77bdab19eec62a4ec6b44a5576ec91eb7ebd33073ef4d70f0b

SHA512
0c593da4c99e6b9eb4c0d8fdd684a3659739d364cafcd774185982e36679a46ba9406c39723cda1f97003ed8482b318333ff2c8733ccdf018a15d79d4323617a

Download Submit
\Windows\system\xaBUOsY.exe

Filesize
2.2MB

MD5
b8b4b397f9266cad954e97257921723f

SHA1
0a7ad030d2905f839ba062d2e44d7dd94659a161

SHA256
d93967f0ed3b259aa1cbe9dd1d4b7b8ad194aa6557e88ec831765ebf00161222

SHA512
a9084431424915a8d109e113b3e0626d1fab1b5808e669fa69dc3546db521147d2ca099920b818f688b144a05e94d5a4b1957d511c8e523b44a04fafec75b3fb

Download Submit
memory/2052-5693-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2052-81-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2092-8-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-71-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-360-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-20-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-16-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-5661-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-116-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-40-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-1164-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-117-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/2172-115-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2172-986-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2172-33-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2220-4-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-118-0x0000000003580000-0x0000000003972000-memory.dmp

Filesize
3.9MB

Download
memory/2220-56-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2220-17-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-39-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-119-0x0000000003580000-0x0000000003972000-memory.dmp

Filesize
3.9MB

Download
memory/2220-108-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2220-75-0x0000000003580000-0x0000000003972000-memory.dmp

Filesize
3.9MB

Download
memory/2220-23-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2220-0-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-58-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2432-5682-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2468-1862-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2468-46-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2552-63-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2552-5725-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2692-32-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2692-985-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2712-57-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-5749-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download